attack.mitre.org
Open in
urlscan Pro
2606:50c0:8000::153
Public Scan
Submitted URL: http://support-eu.lionnets.com/download?a=64d42e9a420fd51a6209b553
Effective URL: https://attack.mitre.org/techniques/T1566/002/
Submission Tags: falconsandbox
Submission: On August 10 via api from US — Scanned from DE
Effective URL: https://attack.mitre.org/techniques/T1566/002/
Submission Tags: falconsandbox
Submission: On August 10 via api from US — Scanned from DE
Summary
This website contacted 8 IPs
in 3 countries
across 6 domains to perform 43 HTTP transactions.
The main IP is 2606:50c0:8000::153, located in
United States and
belongs to FASTLY, US.
The main domain is attack.mitre.org.
The Cisco Umbrella rank of the primary domain is 287939.
TLS certificate: Issued by R3 on July 29th 2023. Valid for: 3 months.
This is the only time attack.mitre.org was scanned on urlscan.io!
TLS certificate: Issued by R3 on July 29th 2023. Valid for: 3 months.
This is the only time attack.mitre.org was scanned on urlscan.io!
urlscan.io Verdict: No classification
Downloads These files were downloaded by the website
MIME: RAR archive data, v5
Size: 19 KB (19184 bytes, 100% done)
Downloaded from: https://cym-files-download.s3.eu-west-1.amazonaws.com/apt-files/7c204fb0-3714-11ee-8b6a-4f9df6dbeb7c/64d42e9a420fd51a6209b553/Formulario.rar?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIAJPJC2Q3D5GWFTK3Q%2F20230810%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20230810T010908Z&X-Amz-Expires=259200&X-Amz-Signature=40aa47c3fdbfea905525446202b8cc5a07577fe1c15dc3c7468ca1c233665285&X-Amz-SignedHeaders=host&x-id=GetObject
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 52.16.167.99 52.16.167.99 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 52.218.105.155 52.218.105.155 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 2606:4700:10:... 2606:4700:10::6816:5f1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 35 | 2606:50c0:800... 2606:50c0:8000::153 | 54113 (FASTLY) (FASTLY) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:82b::2008 | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:827::200e | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2001:4860:480... 2001:4860:4802:34::36 | () () | |
| 43 | 8 |
1
52.16.167.99
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-167-99.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-167-99.eu-west-1.compute.amazonaws.com
| support-eu.lionnets.com |
1
52.218.105.155
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1-r-w.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1-r-w.amazonaws.com
| cym-files-download.s3.eu-west-1.amazonaws.com |
2
2a00:1450:4001:82b::2008
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| www.googletagmanager.com |
2
2a00:1450:4001:827::200e
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| www.google-analytics.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 35 |
mitre.org
1 redirects
attack.mitre.org — Cisco Umbrella Rank: 287939 |
4 MB |
| 4 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 54 region1.google-analytics.com |
21 KB |
| 2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 65 |
129 KB |
| 1 |
cymulate.com
app.cymulate.com — Cisco Umbrella Rank: 259098 |
|
| 1 |
amazonaws.com
cym-files-download.s3.eu-west-1.amazonaws.com — Cisco Umbrella Rank: 901352 |
|
| 1 |
lionnets.com
support-eu.lionnets.com |
2 KB |
| 43 | 6 |
| Domain | Requested by | |
|---|---|---|
| 35 | attack.mitre.org |
1 redirects
support-eu.lionnets.com
attack.mitre.org |
| 2 | region1.google-analytics.com |
www.googletagmanager.com
|
| 2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
| 2 | www.googletagmanager.com |
attack.mitre.org
www.googletagmanager.com |
| 1 | app.cymulate.com |
support-eu.lionnets.com
|
| 1 | cym-files-download.s3.eu-west-1.amazonaws.com |
support-eu.lionnets.com
|
| 1 | support-eu.lionnets.com | |
| 43 | 7 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.s3-eu-west-1.amazonaws.com Amazon RSA 2048 M01 |
2023-07-10 - 2024-05-31 |
a year | crt.sh |
| cymulate.com Cloudflare Inc ECC CA-3 |
2022-12-09 - 2023-12-09 |
a year | crt.sh |
| attack.mitre.org R3 |
2023-07-29 - 2023-10-27 |
3 months | crt.sh |
| *.google-analytics.com GTS CA 1C3 |
2023-07-17 - 2023-10-09 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://attack.mitre.org/techniques/T1566/002/
Frame ID: F16295D25D2A99A36EE0BBF7AA6C7530
Requests: 44 HTTP requests in this frame
Frame:
https://cym-files-download.s3.eu-west-1.amazonaws.com/apt-files/7c204fb0-3714-11ee-8b6a-4f9df6dbeb7c/64d42e9a420fd51a6209b553/Formulario.rar?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIAJPJC2Q3D5GWFTK3Q%2F20230810%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20230810T010908Z&X-Amz-Expires=259200&X-Amz-Signature=40aa47c3fdbfea905525446202b8cc5a07577fe1c15dc3c7468ca1c233665285&X-Amz-SignedHeaders=host&x-id=GetObject
Frame ID: 6932B4C7326C8006445F008BA686264E
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®Page URL History Show full URLs
- http://support-eu.lionnets.com/download?a=64d42e9a420fd51a6209b553 Page URL
- https://attack.mitre.org/techniques/T1192/ Page URL
-
https://attack.mitre.org/techniques/T1566/002
HTTP 301
https://attack.mitre.org/techniques/T1566/002/ Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- googletagmanager\.com/gtag/js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
118 Outgoing links
These are links going to different origins than the main page.
URL: https://medium.com/mitre-attack/
Title: Blog
Title: Blog
Search URL Search Domain Scan URL
URL: https://us-cert.cisa.gov/ncas/tips/ST05-016
Title: [1]
Title: [1]
Search URL Search Domain Scan URL
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks
Title: [2]
Title: [2]
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/
Title: [3]
Title: [3]
Search URL Search Domain Scan URL
URL: https://o365blog.com/aadinternals
Title: [4]
Title: [4]
Search URL Search Domain Scan URL
URL: https://us-cert.cisa.gov/ncas/alerts/aa21-048a
Title: [5]
Title: [5]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
Title: [6]
Title: [6]
Search URL Search Domain Scan URL
URL: https://www.justice.gov/file/1080281/download
Title: [7]
Title: [7]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/
Title: [8]
Title: [8]
Search URL Search Domain Scan URL
URL: https://www.justice.gov/opa/page/file/1098481/download
Title: [9]
Title: [9]
Search URL Search Domain Scan URL
URL: https://www.secureworks.com/research/iron-twilight-supports-active-measures
Title: [10]
Title: [10]
Search URL Search Domain Scan URL
URL: http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
Title: [11]
Title: [11]
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
Title: [12]
Title: [12]
Search URL Search Domain Scan URL
URL: https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure
Title: [13]
Title: [13]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html
Title: [14]
Title: [14]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
Title: [15]
Title: [15]
Search URL Search Domain Scan URL
URL: https://www.cybereason.com/blog/operation-cobalt-kitty-apt
Title: [16]
Title: [16]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html
Title: [17]
Title: [17]
Search URL Search Domain Scan URL
URL: https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
Title: [18]
Title: [18]
Search URL Search Domain Scan URL
URL: https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf
Title: [19]
Title: [19]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
Title: [20]
Title: [20]
Search URL Search Domain Scan URL
URL: https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage
Title: [21]
Title: [21]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
Title: [22]
Title: [22]
Search URL Search Domain Scan URL
URL: https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf
Title: [23]
Title: [23]
Search URL Search Domain Scan URL
URL: https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles
Title: [24]
Title: [24]
Search URL Search Domain Scan URL
URL: https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware
Title: [25]
Title: [25]
Search URL Search Domain Scan URL
URL: https://www.crowdstrike.com/blog/wizard-spider-adversary-update/
Title: [26]
Title: [26]
Search URL Search Domain Scan URL
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/
Title: [27]
Title: [27]
Search URL Search Domain Scan URL
URL: https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
Title: [28]
Title: [28]
Search URL Search Domain Scan URL
URL: https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
Title: [29]
Title: [29]
Search URL Search Domain Scan URL
URL: https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html
Title: [30]
Title: [30]
Search URL Search Domain Scan URL
URL: https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
Title: [31]
Title: [31]
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
Title: [32]
Title: [32]
Search URL Search Domain Scan URL
URL: https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html
Title: [33]
Title: [33]
Search URL Search Domain Scan URL
URL: https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish
Title: [34]
Title: [34]
Search URL Search Domain Scan URL
URL: https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html
Title: [35]
Title: [35]
Search URL Search Domain Scan URL
URL: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf
Title: [36]
Title: [36]
Search URL Search Domain Scan URL
URL: https://web.archive.org/web/20190717233006/http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf
Title: [37]
Title: [37]
Search URL Search Domain Scan URL
URL: https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China
Title: [38]
Title: [38]
Search URL Search Domain Scan URL
URL: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
Title: [39]
Title: [39]
Search URL Search Domain Scan URL
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/
Title: [40]
Title: [40]
Search URL Search Domain Scan URL
URL: https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
Title: [41]
Title: [41]
Search URL Search Domain Scan URL
URL: https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/
Title: [42]
Title: [42]
Search URL Search Domain Scan URL
URL: https://support.malwarebytes.com/docs/DOC-2295
Title: [43]
Title: [43]
Search URL Search Domain Scan URL
URL: https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor
Title: [44]
Title: [44]
Search URL Search Domain Scan URL
URL: https://www.us-cert.gov/ncas/alerts/TA18-201A
Title: [45]
Title: [45]
Search URL Search Domain Scan URL
URL: https://blog.talosintelligence.com/2019/01/return-of-emotet.html
Title: [46]
Title: [46]
Search URL Search Domain Scan URL
URL: https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html
Title: [47]
Title: [47]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
Title: [48]
Title: [48]
Search URL Search Domain Scan URL
URL: https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/
Title: [49]
Title: [49]
Search URL Search Domain Scan URL
URL: https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf
Title: [50]
Title: [50]
Search URL Search Domain Scan URL
URL: https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html
Title: [51]
Title: [51]
Search URL Search Domain Scan URL
URL: https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/
Title: [52]
Title: [52]
Search URL Search Domain Scan URL
URL: https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html
Title: [53]
Title: [53]
Search URL Search Domain Scan URL
URL: https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/
Title: [54]
Title: [54]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
Title: [55]
Title: [55]
Search URL Search Domain Scan URL
URL: https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
Title: [56]
Title: [56]
Search URL Search Domain Scan URL
URL: https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/
Title: [57]
Title: [57]
Search URL Search Domain Scan URL
URL: https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
Title: [58]
Title: [58]
Search URL Search Domain Scan URL
URL: https://blog.alyac.co.kr/2234
Title: [59]
Title: [59]
Search URL Search Domain Scan URL
URL: https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/
Title: [60]
Title: [60]
Search URL Search Domain Scan URL
URL: https://www.boho.or.kr/krcert/publicationView.do?bulletin_writing_sequence=35936
Title: [61]
Title: [61]
Search URL Search Domain Scan URL
URL: https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf
Title: [62]
Title: [62]
Search URL Search Domain Scan URL
URL: https://securelist.com/lazarus-threatneedle/100803/
Title: [63]
Title: [63]
Search URL Search Domain Scan URL
URL: https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets
Title: [64]
Title: [64]
Search URL Search Domain Scan URL
URL: https://us-cert.cisa.gov/ncas/alerts/aa21-200a
Title: [65]
Title: [65]
Search URL Search Domain Scan URL
URL: https://securelist.com/apt-luminousmoth/103332/
Title: [66]
Title: [66]
Search URL Search Domain Scan URL
URL: https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html
Title: [67]
Title: [67]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf
Title: [68]
Title: [68]
Search URL Search Domain Scan URL
URL: https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations
Title: [69]
Title: [69]
Search URL Search Domain Scan URL
URL: https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf
Title: [70]
Title: [70]
Search URL Search Domain Scan URL
URL: https://blog.certfa.com/posts/charming-kitten-christmas-gift/
Title: [71]
Title: [71]
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021
Title: [72]
Title: [72]
Search URL Search Domain Scan URL
URL: https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf
Title: [73]
Title: [73]
Search URL Search Domain Scan URL
URL: https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/
Title: [74]
Title: [74]
Search URL Search Domain Scan URL
URL: https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
Title: [75]
Title: [75]
Search URL Search Domain Scan URL
URL: https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html
Title: [76]
Title: [76]
Search URL Search Domain Scan URL
URL: https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf
Title: [77]
Title: [77]
Search URL Search Domain Scan URL
URL: https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf
Title: [78]
Title: [78]
Search URL Search Domain Scan URL
URL: https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/
Title: [79]
Title: [79]
Search URL Search Domain Scan URL
URL: https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf
Title: [80]
Title: [80]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf
Title: [81]
Title: [81]
Search URL Search Domain Scan URL
URL: https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
Title: [82]
Title: [82]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/
Title: [83]
Title: [83]
Search URL Search Domain Scan URL
URL: http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries
Title: [84]
Title: [84]
Search URL Search Domain Scan URL
URL: https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf
Title: [85]
Title: [85]
Search URL Search Domain Scan URL
URL: https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/
Title: [86]
Title: [86]
Search URL Search Domain Scan URL
URL: https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/
Title: [87]
Title: [87]
Search URL Search Domain Scan URL
URL: https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files
Title: [88]
Title: [88]
Search URL Search Domain Scan URL
URL: https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks
Title: [89]
Title: [89]
Search URL Search Domain Scan URL
URL: https://success.trendmicro.com/solution/000283381
Title: [90]
Title: [90]
Search URL Search Domain Scan URL
URL: https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot
Title: [91]
Title: [91]
Search URL Search Domain Scan URL
URL: https://securelist.com/qakbot-technical-analysis/103931/
Title: [92]
Title: [92]
Search URL Search Domain Scan URL
URL: https://groupib.pathfactory.com/ransomware-reports/prolock_wp
Title: [93]
Title: [93]
Search URL Search Domain Scan URL
URL: https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
Title: [94]
Title: [94]
Search URL Search Domain Scan URL
URL: https://www.justice.gov/opa/press-release/file/1328521/download
Title: [95]
Title: [95]
Search URL Search Domain Scan URL
URL: https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf
Title: [96]
Title: [96]
Search URL Search Domain Scan URL
URL: https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/
Title: [97]
Title: [97]
Search URL Search Domain Scan URL
URL: https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike
Title: [98]
Title: [98]
Search URL Search Domain Scan URL
URL: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter
Title: [99]
Title: [99]
Search URL Search Domain Scan URL
URL: https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
Title: [100]
Title: [100]
Search URL Search Domain Scan URL
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/
Title: [101]
Title: [101]
Search URL Search Domain Scan URL
URL: https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader
Title: [102]
Title: [102]
Search URL Search Domain Scan URL
URL: https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html
Title: [103]
Title: [103]
Search URL Search Domain Scan URL
URL: https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html
Title: [104]
Title: [104]
Search URL Search Domain Scan URL
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Title: [105]
Title: [105]
Search URL Search Domain Scan URL
URL: https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf
Title: [106]
Title: [106]
Search URL Search Domain Scan URL
URL: https://assets.sentinelone.com/labs/sentinel-one-valak-i
Title: [107]
Title: [107]
Search URL Search Domain Scan URL
URL: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf
Title: [108]
Title: [108]
Search URL Search Domain Scan URL
URL: https://us-cert.cisa.gov/ncas/alerts/aa20-302a
Title: [109]
Title: [109]
Search URL Search Domain Scan URL
URL: https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/
Title: [110]
Title: [110]
Search URL Search Domain Scan URL
URL: https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/
Title: [111]
Title: [111]
Search URL Search Domain Scan URL
URL: https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/
Title: [112]
Title: [112]
Search URL Search Domain Scan URL
URL: https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online
Title: [113]
Title: [113]
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
Title: [114]
Title: [114]
Search URL Search Domain Scan URL
URL: https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
Title: [115]
Title: [115]
Search URL Search Domain Scan URL
URL: https://www.mitre.org/
Search URL Search Domain Scan URL
URL: https://twitter.com/MITREattack
Title: @MITREattack
Title: @MITREattack
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://support-eu.lionnets.com/download?a=64d42e9a420fd51a6209b553 Page URL
- https://attack.mitre.org/techniques/T1192/ Page URL
-
https://attack.mitre.org/techniques/T1566/002
HTTP 301
https://attack.mitre.org/techniques/T1566/002/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
43 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
download
support-eu.lionnets.com/ |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Formulario.rar
cym-files-download.s3.eu-west-1.amazonaws.com/apt-files/7c204fb0-3714-11ee-8b6a-4f9df6dbeb7c/64d42e9a420fd51a6209b553/ Frame 6932 |
0 0 |
Document
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
64d42e9a420fd51a6209b553
app.cymulate.com/api/phishing/clicked/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
attack.mitre.org/techniques/T1192/ |
67 B 458 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
attack.mitre.org/techniques/T1566/002/ Redirect Chain
|
512 KB 55 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
www.googletagmanager.com/gtag/ |
125 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
attack.mitre.org/theme/style/ |
152 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-glyphicon.min.css
attack.mitre.org/theme/style/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-tourist.css
attack.mitre.org/theme/style/ |
2 KB 948 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-select.min.css
attack.mitre.org/theme/style/ |
11 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
attack.mitre.org/theme/ |
45 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mitre_attack_logo.png
attack.mitre.org/theme/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
external-site.svg
attack.mitre.org/theme/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mitrelogowhiteontrans.gif
attack.mitre.org/theme/images/ |
661 B 878 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
twitter.png
attack.mitre.org/theme/images/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.5.1.min.js
attack.mitre.org/theme/scripts/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
popper.min.js
attack.mitre.org/theme/scripts/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-select.min.js
attack.mitre.org/theme/scripts/ |
52 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.bundle.min.js
attack.mitre.org/theme/scripts/ |
79 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
site.js
attack.mitre.org/theme/scripts/ |
1 KB 705 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
settings.js
attack.mitre.org/theme/scripts/ |
299 B 458 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
search_bundle.js
attack.mitre.org/theme/scripts/ |
400 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
navigation.js
attack.mitre.org/theme/scripts/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-tourist.js
attack.mitre.org/theme/scripts/ |
80 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
settings.js
attack.mitre.org/theme/scripts/ |
299 B 445 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tour-subtechniques.js
attack.mitre.org/theme/scripts/tour/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
387 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
197 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Roboto-Regular.ttf
attack.mitre.org/theme/fonts/Roboto/ |
168 KB 89 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Roboto-Light.ttf
attack.mitre.org/theme/fonts/Roboto/ |
166 KB 89 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Roboto-Thin.ttf
attack.mitre.org/theme/fonts/Roboto/ |
168 KB 88 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
campaigns.json
attack.mitre.org/search/ |
143 KB 37 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
datasources.json
attack.mitre.org/search/ |
776 KB 162 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
groups.json
attack.mitre.org/search/ |
1 MB 274 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
matrices.json
attack.mitre.org/search/ |
162 KB 17 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
misc.json
attack.mitre.org/search/ |
523 KB 140 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mitigations.json
attack.mitre.org/search/ |
512 KB 108 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
software.json
attack.mitre.org/search/ |
2 MB 588 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tactics.json
attack.mitre.org/search/ |
461 KB 126 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
techniques.json
attack.mitre.org/search/ |
6 MB 2 MB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
www.googletagmanager.com/gtag/ |
233 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
region1.google-analytics.com/g/ |
0 254 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 206 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
region1.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer function| $ function| jQuery function| Popper object| bootstrap function| positionBody function| initSidenavScroll string| base_url string| build_uuid object| tour_steps object| google_tag_manager object| google_tag_data function| Tour function| start_tour boolean| isSiteTour string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .mitre.org/ | Name: _ga_C8EHW4DS2X Value: GS1.1.1691692237.1.0.1691692237.0.0.0 |
|
| .mitre.org/ | Name: _ga Value: GA1.2.1852556734.1691692237 |
|
| .mitre.org/ | Name: _gid Value: GA1.2.313715369.1691692237 |
|
| .mitre.org/ | Name: _gat_gtag_UA_62667723_1 Value: 1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval' |
| Strict-Transport-Security | max-age=15552000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.cymulate.com
attack.mitre.org
cym-files-download.s3.eu-west-1.amazonaws.com
region1.google-analytics.com
support-eu.lionnets.com
www.google-analytics.com
www.googletagmanager.com
2001:4860:4802:34::36
2606:4700:10::6816:5f1
2606:50c0:8000::153
2a00:1450:4001:827::200e
2a00:1450:4001:82b::2008
52.16.167.99
52.218.105.155
0b1491c19b4fed56dff4c03dfb02a46bb1a6a5297f3be79e166b7078202acc45
117bc65c2ce02d3f999b4c3e2136e27765e2e7256a3ee75e1310a683d171d3b9
124bbd8d249b86351701081fde6f3584811ecaeaa6a179154ea170d6ad48eff8
2e2b8b0f75125d80b19ed1ac29edbef813b5bf4276b47968cd9f8982c7d1e105
2fd6f83ac5b18733d149c87a9009016df6629a9f1ec90a455965edceddfb8e54
3ae6a7bfab7524a73fda8afb924ee4ebcaede820e4aacbbadfa7a958a45bef93
3d91f7aa69cb7f7064035895c566ac5cb9b2084582d351af7267bb4e0fba60f5
43793ea699220d7fa263ee3d69961b81a9cefc9119c4a637ce12f0ce087b7b0e
45424597b815f4abb6950cd904ff6c99ab0c6373e7a9048cfad94f7a17d2e981
4c46ae428c0391165e1db1aa7c8231828ded1cf34482ba941eb45404a7e7c88a
50d579034cf5e54e53ad48172173f27b9eae3cd1c493c554526510386ac0200c
54afb34633a8680500183f5f99ee59437dbe274df4c5eec3d9570b8ac44ff4a6
55b6d0fa4ad23fca99b440bc7cf5f3c9c0d0eface004a2dbbacc7a0e95c37f25
55f61ce63b8f846de286d53083e0380f2b8898fa15245437a3f960fa9dc27503
565d372d0b682e995f047d82971748a40f631563482a2464945ad2abf51c4c35
5a0a3b9de1516d3bb9cb4f99c8f202117f6888ba5ecca722c1dd05146a202bf2
5f0dab6d3a6d19383d7ce54cf9b6bf60ab80cae0b43e07c0fd2ba3f4626c4d7b
5f62d01c7dc5a5fd0838b99e610ab615942947964633180f89284d43d8f8bde2
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
68e2c8df7986bd3319505fd883e8de7c9ce7e50ea24dfb1421c6dee387f2782c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cf23daa0cd7e06a8b629044fe65a1332e42e2171962297a9e513f4860aeb1f4
734a6a3d4a437089ce38cb1ede5a893f2760014278bd9fc9f6e447d0505ab801
79e851404657dac2106b3d22ad256d47824a9a5765458edb72c9102a45816d95
8117b34e40b234c456830e62ca1e0c3758d7a97111678b28c4d55a1ef3d28d48
8262a137e2548569bb05474333def30bfdc5415d8a37348ee727b6600db493a5
86d45b4603ed85fdb799012f53b5ca7055c201260ab002f50a2359ba9103addb
92232d88078e2a618a3a4a02443fa1df4649718289bb9cec2a3bbd5910b337a4
9547c0128ae015532c24b5f0ab46b633eef58e3ace63a5d4768014e7032a0329
976705f4556d7fb372a1696b61112f0091182e1761a27a7ff261cafb4da551da
a6d343d425bc38db90152fa06058b1c7391eca9264f334ef65c1ce175085c6f6
a8dfc125ca7b8409ed5b4468980b423e0d73f29d566b989aed57f8083259da2f
aa8d026a6e17274410d3a5e70a20856018771835d4e398f7969529f9e9b6c815
abf366824b83e70952d38aef60e540325fe60a571d7f0bd51492429820cee959
c22308edbb8e579501cdd58de2ce245ea13f2d9efde21c79a0938e21094305a3
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfdca3b05eab23d6bb097f95ac5a75f3094e3e213e8f6c152c31d526201f05f9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa56d1290557a7b0734f0b53ee6b8b31e4e36276cfb622f1a48fed56c3188730